CVE-2026-56858: stdlib Package Vulnerability in html/template Leading to Potential XSS
Summary
CVE-2026-56858: Fix Javascript regexp context tracking in html/template. Affects stdlib across 3 version ranges.
< 1.25.13
>= 1.26.0-0, < 1.26.6
>= 1.27.0-0, < 1.27.0-rc.3
Fixed in 1.25.13, 1.26.6 or 1.27.0-rc.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-56858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a comprehensive standard library that includes various modules for handling common programming tasks. Among these, the html/template package is designed to help developers create HTML templates safely by escaping data to prevent injection attacks. However, this package has been found to have a vulnerability that could allow for cross-site scripting (XSS) attacks under certain conditions.
Vulnerability Detail
The vulnerability arises from improper handling of JavaScript regular expression context tracking within the html/template package. Specifically, pathological inputs can prematurely close an unescaped '/' character, allowing attackers to inject arbitrary content into the application. This could lead to severe security implications, including the execution of malicious scripts in the context of the user's browser, thereby compromising user data and application integrity.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.25.131.25.13go get stdlib@v1.25.13 -
>= 1.26.0-0, < 1.26.61.26.6go get stdlib@v1.26.6 -
>= 1.27.0-0, < 1.27.0-rc.31.27.0-rc.3go get stdlib@v1.27.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can sanitize inputs to the html/template package to prevent the injection of untrusted data. This can be done by validating and escaping user inputs before they are processed by the template engine.
Conclusion
The CVE-2026-56858 vulnerability in the stdlib package's html/template module poses a significant risk of XSS attacks. It is crucial for developers to update to the patched versions to secure their applications. Additionally, implementing input validation can serve as a temporary measure to mitigate potential risks.
See every vulnerability recorded for stdlib →
FAQ
CVE-2026-56858 is a vulnerability in the stdlib package's html/template module that can lead to cross-site scripting (XSS) attacks.
If your application uses the affected versions of the html/template package, it may be susceptible to XSS attacks, allowing attackers to execute malicious scripts.
Affected versions include all versions prior to 1.25.13, 1.26.0-0, and 1.27.0-0, as well as their respective release candidates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, ensure to sanitize and validate all user inputs to minimize the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
