CVE-2026-97030: fallo de gravedad media en Go standard library html/template
Recognize yield as regexp preceder keyword in html/template
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Go standard library · html/templateCVEs relacionadas — Go standard library html/template
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-24538CRITICALBackticks not treated as string delimiters in html/templateEPSS 2.3%CVE-2023-24540CRITICALImproper handling of JavaScript whitespace in html/templateEPSS 1.6%CVE-2023-24539HIGHImproper sanitization of CSS values in html/templateEPSS 1.0%CVE-2023-29400HIGHImproper handling of empty HTML attributes in html/templateEPSS 1.0%CVE-2023-39318—Improper handling of HTML-like comments in script contexts in html/templateEPSS 0.9%CVE-2023-39319—Improper handling of special tags within script contexts in html/templateEPSS 0.9%