Logo
›
›vulnerability›CVE-2026-39826
Name
CVE-2026-39826
Source
NVD ( link)Debian ( link)
Description
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
CWEs
CWE-116
Published Date
Updated Date
Workaround
-
Advisories
https://go.dev/cl/771180Patch
https://go.dev/issue/78981Patch
https://groups.google.com/g/golang-announce/c/qcCIEXso47MRelease Notes
https://pkg.go.dev/vuln/GO-2026-4980Vendor Advisory

Analysis#

Affected Component
Analysis
golang-bootstrap
Exploitable

Vulnerability Ratings#

6.1
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
golang-bootstrap
openwrt
master
1.24.13-r1
Exploitable
golang1.26
openwrt
master
1.26.4-r1
Not Affected
go
yocto
kirkstone
1.17.13
Exploitable
go-binary-native
yocto
kirkstone
1.17.13
Exploitable
go
yocto
master
1.26.4
Not Affected
go-binary-native
yocto
master
1.26.4
Not Affected
go
yocto
scarthgap
1.22.12
Patched
go-binary-native
yocto
scarthgap
1.22.12
Exploitable

Resolved with patches#

go (yocto:scarthgap)

#
Title
Author
Resolve
1
html/template: fix escaper bypass by treating empty script
Neal Patel <nealpatel@google.com>
CVE-2026-39826