Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Go standard library html/template 1.25.10, 1.26.3 Clear all filters
TI-2026-28705 CVE-2026-39823 · GHSA-2283-wf8c-rw8r

Bypass of meta content URL escaping causes XSS in html/template

Priority LOW 27

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00314 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-79
TI-2026-28708 CVE-2026-39826 · GHSA-3v2c-x6q9-f697

Escaper bypass leads to XSS in html/template

Priority LOW 27

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into t…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00371 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-116