Go html/template <script> type attr escape flaw before 1.25.10 & <1.26.3
CVE-2026-39826 Published on May 7, 2026
Escaper bypass leads to XSS in html/template
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
Vulnerability Analysis
CVE-2026-39826 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Products Associated with CVE-2026-39826
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go standard library html/template:- Before 1.25.10 is affected.
- Version 1.26.0-0 and below 1.26.3 is affected.