Executive brief
A vulnerability in the Go programming language's standard HTML template library could allow attackers to execute malicious scripts in a user's browser. This occurs when a developer uses specific formatting in a script tag, causing the library to fail to properly sanitize data. An exploit could lead to unauthorized actions or the theft of sensitive information from users visiting a site built with the affected library.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Go 'html/template' standard library package. The issue is rooted in the contextual auto-escaper, which fails to properly sanitize data passed into a <script> block if the tag contains an empty 'type' attribute (type="") or a 'type' attribute containing only ASCII whitespace. An attacker can exploit this by providing malicious input that is then rendered into such a template, bypassing the intended security boundaries to execute arbitrary JavaScript in the context of the victim's browser. The vulnerability affects Go versions prior to 1.25.10 and versions 1.26.x prior to 1.26.3. Patches have been released in Go 1.25.10 and 1.26.3.
Affected products
- Google Go < 1.25.10, >= 1.26.0 < 1.26.3
Timeline
- 2026-04-27: disclosed: Issue reported to Go project
- 2026-05-07: advisory: Initial CVE publication and Go vulnerability report
- 2026-05-07: patched: Patched versions released