CVE-2026-56858: Golang Package Vulnerability Leading to Potential XSS via Regexp Context Tracking
Summary
CVE-2026-56858: Fix Javascript regexp context tracking in html/template. Affects golang across 3 version ranges.
< 1.25.13
>= 1.26.0-0, < 1.26.6
>= 1.27.0-0, < 1.27.0
Fixed in 1.25.13, 1.26.6 or 1.27.0, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-56858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software applications. The language's html/template package is essential for safely generating HTML output from data. However, it has been found to have a vulnerability that can lead to cross-site scripting (XSS) attacks if not addressed.
Vulnerability Detail
The vulnerability arises from improper handling of Javascript regular expressions within the html/template package. Specifically, pathological inputs can prematurely close an unescaped '/', allowing attackers to inject arbitrary content into the output. This can lead to severe security implications, including XSS, where malicious scripts can be executed in the context of a user's browser, potentially compromising sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.25.131.25.13 -
>= 1.26.0-0, < 1.26.61.26.6 -
>= 1.27.0-0, < 1.27.01.27.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can sanitize inputs to the html/template package to avoid untrusted data being processed. This may involve escaping certain characters or validating input data before it is passed to the template.
Conclusion
The CVE-2026-56858 vulnerability in the Golang package poses a significant risk of XSS attacks due to improper handling of Javascript regular expressions. It is crucial for developers to update to the patched versions to safeguard their applications. Additionally, using input sanitization can serve as a temporary measure until updates are applied.
See every vulnerability recorded for golang →
FAQ
CVE-2026-56858 is a vulnerability in the Golang package that allows for potential XSS attacks due to improper handling of Javascript regular expressions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to inject malicious scripts into web applications, leading to data theft, session hijacking, and other security breaches.
Yes, patches are available in versions 1.25.13, 1.26.6, and 1.27.0 of the Golang package.
If an immediate update is not possible, ensure to sanitize inputs to the html/template package to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
