Skip to contentGo Standard Library Html/template vulnerabilities
- go standard library html/templateRecognize yield as regexp preceder keyword in html/templateCVE-2026-97030Fix available6.1 Medium
- go standard library html/templateReset context tracking on consecutive template expressions in html/templateCVE-2026-94448Fix available6.1 Medium
- go standard library html/templateFix Javascript regexp context tracking in html/templateCVE-2026-56858Fix available6.1 Medium
- go standard library html/template, golang go +1 moreEscaper bypass leads to XSS in html/templateCVE-2026-39826Fix available6.1 Medium
- go standard library html/template, golang go +1 moreBypass of meta content URL escaping causes XSS in html/templateCVE-2026-39823Fix available6.1 Medium
- go standard library html/template, golang go +1 moreJsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289Fix available6.1 Medium
- go standard library html/template, golang go +1 moreURLs in meta content attribute actions are not escaped in html/templateCVE-2026-27142Fix available6.1 Medium
- go standard library html/templateErrors returned from JSON marshaling may break template escaping in html/templateCVE-2024-24785Fix available5.4 Medium
- go standard library html/template, golang go +1 moreImproper handling of special tags within script contexts in html/templateCVE-2023-39319Fix available6.1 Medium
- go standard library html/template, golang go +1 moreImproper handling of HTML-like comments in script contexts in html/templateCVE-2023-39318Fix available6.1 Medium
- go standard library html/template, golang go +1 moreImproper handling of empty HTML attributes in html/templateCVE-2023-29400Fix available7.3 High
- go standard library html/template, golang go +1 moreImproper handling of JavaScript whitespace in html/templateCVE-2023-24540Fix available9.8 Critical
- go standard library html/template, golang go +1 moreImproper sanitization of CSS values in html/templateCVE-2023-24539Fix available7.3 High
- go standard library html/template, golang go +1 moreBackticks not treated as string delimiters in html/templateCVE-2023-24538Public exploitFix available9.8 Critical