Search: CVE-2026-39826

CVE-2026-39826 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs when a trusted template author includes a <script> tag with an empty or whitespace-only 'type' attribute, leading to improper escaping of data inside the script block. This can allow injection of malicious scripts if untrusted data is passed into the template. The vulnerability affects Go versions up to and including 1.26.0-0. There is no official patch or remediation guidance available, and no known exploits have been reported in the wild.