Skip to main content
cve.nowby Sazabi
← Go
GoPackage

html/template

12 known vulnerabilities (2 critical, 2 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 2 critical, 2 high, 6 medium
Registry
pkg.go.dev

Advisories 12

  • CVE-2026-56858Medium 6.1

    Fix Javascript regexp context tracking in html/template

    Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

  • CVE-2026-39823Medium 6.1

    Bypass of meta content URL escaping causes XSS in html/template

    Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

  • CVE-2026-39826Medium 6.1

    Escaper bypass leads to XSS in html/template

    Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

  • CVE-2026-32289Medium 6.1

    JsBraceDepth Context Tracking Bugs (XSS) in html/template

    Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

  • CVE-2026-27142Medium 6.1

    URLs in meta content attribute actions are not escaped in html/template

    Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.

  • CVE-2024-24785Medium 5.4

    Errors returned from JSON marshaling may break template escaping in html/template

    Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

  • Improper handling of special tags within script contexts in html/template

    Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

  • Improper handling of HTML-like comments in script contexts in html/template

    Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

  • Improper sanitization of CSS values in html/template

    Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

  • CVE-2023-24540Critical 9.8

    Improper handling of JavaScript whitespace in html/template

    Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

  • Improper handling of empty HTML attributes in html/template

    Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

  • CVE-2023-24538Critical 9.8

    Backticks not treated as string delimiters in html/template

    Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.