CVE-2026-39826 PUBLISHED

Escaper bypass leads to XSS in html/template

Assigner: Go
Reserved: 07.04.2026 Published: 07.05.2026 Updated: 07.05.2026

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Product Status

Vendor Go standard library
Product html/template
Versions Default: unaffected
  • affected from 0 to 1.25.10 (excl.)
  • affected from 1.26.0-0 to 1.26.3 (excl.)

Credits

  • Mundur (https://github.com/M0nd0R)

References

Problem Types

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')