CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-56858

The CVE-2026-56858 issue concerns Go’s html/template component, where pathological inputs could prematurely close an unescaped "/", enabling attack-controlled data to inject arbitrary content and potentially cause XSS. This is tied to the underlying JavaScript regexp context tracking in html/temp...

CVE-2026-56858 Fix Javascript regexp context tracking in html/template

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...