Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Oct 8, 2026A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.CVE-2026-97030 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.CVE-2026-94448 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.CVE-2026-56858 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of CVE-2026-39826 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute.CVE-2026-39823 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used.CVE-2026-32289 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Actions which insert URLs into the content attribute of HTML meta tags are not escaped.CVE-2026-27142 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template pCVE-2024-24785 · Other software · Go standard library · reported by security@golang.orgMedium 5.4
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.CVE-2023-39319 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.CVE-2023-39318 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Templates containing actions in unquoted HTML attributes (e.g.CVE-2023-29400 · Other software · Go standard library · reported by security@golang.orgHigh 7.3
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Not all valid JavaScript whitespace characters are considered to be whitespace.CVE-2023-24540 · Other software · Go standard library · reported by security@golang.orgCritical 9.8
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.CVE-2023-24539 · Other software · Go standard library · reported by security@golang.orgHigh 7.3
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.CVE-2023-24538 · Other software · Go standard library · reported by security@golang.orgCritical 9.8
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.