CVE-2026-56858

The CVE-2026-56858 issue concerns Go’s html/template component, where pathological inputs could prematurely close an unescaped "/", enabling attack-controlled data to inject arbitrary content and potentially cause XSS. This is tied to the underlying JavaScript regexp context tracking in html/temp...