CVE-2026-97030: Golang Package Vulnerability in HTML Template Yield Keyword Handling
Summary
CVE-2026-97030: Recognize yield as regexp preceder keyword in html/template. Affects golang across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-97030 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang package, maintained by Bitnami, is a widely used programming language known for its simplicity and efficiency in building scalable applications. It supports concurrent programming and is often utilized in web development, cloud services, and microservices architecture. However, a recent vulnerability has been identified in the HTML/template functionality, specifically concerning the handling of the 'yield' keyword, which could lead to improper escaping in templates.
Vulnerability Detail
The vulnerability arises from the incorrect handling of the 'yield' keyword in trusted templates, where it may not be properly escaped. This could allow an attacker to manipulate the template rendering process, potentially leading to cross-site scripting (XSS) attacks or other security issues. The flaw is particularly concerning for applications that rely on user-generated templates, as it could expose sensitive data or allow unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9 -
>= 1.27.0-0, < 1.27.21.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually escape the 'yield' keyword in their templates to prevent it from being misinterpreted. For example, instead of using 'yield', use 'yield' in a safe context to ensure it is treated as a non-keyword.
Conclusion
The CVE-2026-97030 vulnerability in the Golang package highlights the importance of proper template handling in web applications. By updating to the latest versions or implementing workarounds, developers can protect their applications from potential security threats.
See every vulnerability recorded for golang →
FAQ
CVE-2026-97030 is a vulnerability in the Golang package that affects the handling of the 'yield' keyword in HTML templates, potentially leading to security risks.
If your application uses trusted templates with the 'yield' keyword, it may be vulnerable to improper escaping, which could lead to XSS attacks or data exposure.
Versions prior to 1.26.9 and 1.27.2 are affected. It is crucial to update to these versions or later to mitigate the vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, consider implementing manual escaping for the 'yield' keyword in your templates as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
