Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-56858

Fix Javascript regexp context tracking in html/template

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library html/template

Default version status: unaffected

  • 0 to < 1.25.13affected
  • 1.26.0-0 to < 1.26.6affected
  • 1.27.0-0 to < 1.27.0-rc.3affected

References