CVE-2026-39826

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.

This Moderate cross-site scripting (XSS) vulnerability in Go's html/template package occurs when a script tag with an empty or whitespace-only 'type' attribute is used in a template, causing the template engine to incorrectly escape data passed into the script block. This requires a trusted template author to introduce the vulnerable template pattern before an attacker can inject malicious scripts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.