# html/template (Go) vulnerabilities

12 known vulnerabilities (2 critical, 2 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/html/template

## Advisories (12)

### [CVE-2026-56858](https://cve.now/CVE-2026-56858): Fix Javascript regexp context tracking in html/template

- Severity: Medium 6.1
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-39823](https://cve.now/CVE-2026-39823): Bypass of meta content URL escaping causes XSS in html/template

- Severity: Medium 6.1
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-39826](https://cve.now/CVE-2026-39826): Escaper bypass leads to XSS in html/template

- Severity: Medium 6.1
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-32289](https://cve.now/CVE-2026-32289): JsBraceDepth Context Tracking Bugs (XSS) in html/template

- Severity: Medium 6.1
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-27142](https://cve.now/CVE-2026-27142): URLs in meta content attribute actions are not escaped in html/template

- Severity: Medium 6.1
- Published: Mar 6, 2026
- Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.

### [CVE-2024-24785](https://cve.now/CVE-2024-24785): Errors returned from JSON marshaling may break template escaping in html/template

- Severity: Medium 5.4
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2023-39319](https://cve.now/CVE-2023-39319): Improper handling of special tags within script contexts in html/template

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-39318](https://cve.now/CVE-2023-39318): Improper handling of HTML-like comments in script contexts in html/template

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-24539](https://cve.now/CVE-2023-24539): Improper sanitization of CSS values in html/template

- Severity: High 7.3
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-24540](https://cve.now/CVE-2023-24540): Improper handling of JavaScript whitespace in html/template

- Severity: Critical 9.8
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-29400](https://cve.now/CVE-2023-29400): Improper handling of empty HTML attributes in html/template

- Severity: High 7.3
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-24538](https://cve.now/CVE-2023-24538): Backticks not treated as string delimiters in html/template

- Severity: Critical 9.8
- Published: Apr 6, 2023
- Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/html/template
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.