Is CVE-2026-97030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97030 being exploited in the wild.

How severe is CVE-2026-97030?

Medium severity, with a CVSS score of 6.1, published 8 October 2026.

Which products and versions are affected?

go (Go) prior to fix; stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.

Is there a fix for CVE-2026-97030?

Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97030 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-97030?

Check whether you run go (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97030: Go html/template XSS via missing ES2015+ keywords

CVE-2026-97030 · Severity: medium · CVSS 6.1 · Published 2026-10-08

Go's html/template package, used to safely render templates in web applications, failed to recognize the "yield" keyword as a context where regular expressions require escaping. An attacker who can control template content could inject code that bypasses the template security model, potentially leading to cross-site scripting (XSS) attacks that expose user data or hijack sessions.

Technologies: go (Go), stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-97030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97030 being exploited in the wild.
How severe is CVE-2026-97030?: Medium severity, with a CVSS score of 6.1, published 8 October 2026.
Which products and versions are affected?: go (Go) prior to fix; stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.
Is there a fix for CVE-2026-97030?: Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97030 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-97030?: Check whether you run go (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.2 or later
```
go get stdlib@v1.27.2
```

Technical details

The vulnerability is a missing keyword in the regexpPrecederKeywords list in html/template, which determines when regular expression literals require proper escaping. The "yield" keyword, introduced in ES2015+, was not recognized, allowing an attacker to craft templates where a regex following "yield" would be incorrectly treated as a division operator rather than a regex literal. This is a template injection/XSS vulnerability requiring the attacker to control template source code.

Affected products

Go Go prior to fix

Identifiers

CVE-2026-97030
GO-2026-6600

Timeline

2026-09-28: disclosed: Issue filed as public track
2026-10-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.