CVE-2026-39826: Escaper bypass leads to XSS in html/template
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39826?
CVE-2026-39826 has a medium severity rating due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-39826?
To mitigate CVE-2026-39826, ensure that templates do not allow untrusted input to be passed into <script> blocks.
What products are affected by CVE-2026-39826?
CVE-2026-39826 affects the golang/html/template library.
What vulnerability type is CVE-2026-39826 associated with?
CVE-2026-39826 is associated with cross-site scripting (XSS) due to improper escaping in templates.
What causes the vulnerability in CVE-2026-39826?
The vulnerability occurs when a <script> tag contains an empty 'type' attribute or a 'type' attribute with ASCII whitespace, leading to incorrect data escaping.