BIT-golang-2026-56858

vendorUSosv

Fix Javascript regexp context tracking in html/template

view advisory published 2026-08-19Licence: per source

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-56858US	—	0.31% (24th)	—	2026-08-13
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/807100WEB
https://go.dev/issue/80435WEB
https://groups.google.com/g/golang-announce/c/94pEornpRlIWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-56858WEB
https://pkg.go.dev/vuln/GO-2026-6091WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan