GO-2026-6091

vendorUSosv

Fix Javascript regexp context tracking in html/template

view advisory published 2026-08-13Licence: per source

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-56858US	—	0.31% (24th)	—	2026-08-13
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/807100FIX
https://go.dev/issue/80435REPORT
https://groups.google.com/g/golang-announce/c/94pEornpRlIWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan