CVE-2026-97030

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user's web browser.

This vulnerability is rated as Moderate severity because exploitation requires victim interaction through a web browser and is contingent on an application processing untrusted input within templates that employ the 'yield' keyword. In Red Hat environments, Go is predominantly utilized for backend management daemons, container tooling, and command-line utilities rather than serving dynamic web interfaces via this package. Consequently, typical deployments do not expose web-rendered content to untrusted clients, substantially limiting the attack surface across supported products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.