{"id":"CVE-2026-56858","aliases":["GO-2026-6091","BIT-golang-2026-56858"],"title":"Fix Javascript regexp context tracking in html/template","summary":"Fix Javascript regexp context tracking in html/template","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.27.0-0, < 1.27.0-rc.3"],"patched":["stdlib 1.27.0-rc.3"],"published":"2026-08-13","updated":"2026-09-21","sourceUpdated":"2026-09-21T10:56:39.106034250Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6091","references":[{"url":"https://go.dev/issue/80435"},{"url":"https://go.dev/cl/807100"},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56858.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858"},{"url":"https://pkg.go.dev/vuln/GO-2026-6091"},{"url":"https://access.redhat.com/errata/RHSA-2026:68334"},{"url":"https://access.redhat.com/errata/RHSA-2026:68335"},{"url":"https://access.redhat.com/errata/RHSA-2026:66375"},{"url":"https://access.redhat.com/errata/RHSA-2026:66356"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:65918"},{"url":"https://access.redhat.com/errata/RHSA-2026:61882"},{"url":"https://access.redhat.com/errata/RHSA-2026:67517"},{"url":"https://access.redhat.com/errata/RHSA-2026:66459"},{"url":"https://access.redhat.com/errata/RHSA-2026:65335"},{"url":"https://access.redhat.com/errata/RHSA-2026:67974"},{"url":"https://access.redhat.com/errata/RHSA-2026:66327"},{"url":"https://access.redhat.com/errata/RHSA-2026:63332"},{"url":"https://access.redhat.com/errata/RHSA-2026:64777"},{"url":"https://access.redhat.com/errata/RHSA-2026:60306"},{"url":"https://access.redhat.com/errata/RHSA-2026:63022"},{"url":"https://access.redhat.com/errata/RHSA-2026:63119"},{"url":"https://access.redhat.com/errata/RHSA-2026:65534"},{"url":"https://access.redhat.com/errata/RHSA-2026:65116"},{"url":"https://access.redhat.com/errata/RHSA-2026:65895"},{"url":"https://access.redhat.com/errata/RHSA-2026:64818"},{"url":"https://access.redhat.com/errata/RHSA-2026:63163"},{"url":"https://access.redhat.com/errata/RHSA-2026:60305"},{"url":"https://access.redhat.com/errata/RHSA-2026:62407"},{"url":"https://access.redhat.com/errata/RHSA-2026:63124"},{"url":"https://access.redhat.com/errata/RHSA-2026:66016"},{"url":"https://access.redhat.com/errata/RHSA-2026:62602"},{"url":"https://access.redhat.com/errata/RHSA-2026:65359"},{"url":"https://access.redhat.com/errata/RHSA-2026:62754"},{"url":"https://access.redhat.com/errata/RHSA-2026:62405"},{"url":"https://access.redhat.com/errata/RHSA-2026:62753"},{"url":"https://access.redhat.com/errata/RHSA-2026:62404"},{"url":"https://access.redhat.com/errata/RHSA-2026:65336"}],"tags":["osv","go","csaf","vex","red-hat"],"epss":0.0031,"epssPercentile":0.23997,"cvssSource":"vendor","cwe":["CWE-79"],"ingestedAt":"2026-08-14T19:18:46.627Z","slug":"CVE-2026-56858","body":"## Overview\n\nPreviously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.\n\n## Affected packages\n\n- `stdlib >= 1.27.0-0, < 1.27.0-rc.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.27.0-rc.3`\n\n## Vendor advisories\n\n- **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334)\n- **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335)\n- **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375)\n- **RHSA-2026:66356** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66356)\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918)\n- **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882)\n- **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517)\n- **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459)\n- **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335)\n- **RHSA-2026:67974** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67974)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Zero Trust Workload Identity Manager - Tech Preview, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56858.json)\n- **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327)\n- **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332)\n- **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777)\n- **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306)\n- **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022)\n- **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119)\n- **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534)\n- **RHSA-2026:65116** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65116)\n- **RHSA-2026:65895** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65895)\n- **RHSA-2026:64818** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64818)\n- **RHSA-2026:63163** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63163)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201799,"id":"CVE-2026-56858","ts":1789399725866,"field":"cvss","old":null,"new":"8.1"},{"seq":201798,"id":"CVE-2026-56858","ts":1789399725866,"field":"severity","old":"none","new":"high"},{"seq":200529,"id":"CVE-2026-56858","ts":1789397373793,"field":"cvss","old":"8.1","new":null},{"seq":200528,"id":"CVE-2026-56858","ts":1789397373793,"field":"severity","old":"high","new":"none"},{"seq":198446,"id":"CVE-2026-56858","ts":1789391968813,"field":"cvss","old":null,"new":"8.1"},{"seq":198445,"id":"CVE-2026-56858","ts":1789391968813,"field":"severity","old":"none","new":"high"},{"seq":196239,"id":"CVE-2026-56858","ts":1789383585219,"field":"cvss","old":"8.1","new":null},{"seq":196238,"id":"CVE-2026-56858","ts":1789383585219,"field":"severity","old":"high","new":"none"},{"seq":195168,"id":"CVE-2026-56858","ts":1789380475062,"field":"cvss","old":null,"new":"8.1"},{"seq":195167,"id":"CVE-2026-56858","ts":1789380475062,"field":"severity","old":"none","new":"high"},{"seq":193955,"id":"CVE-2026-56858","ts":1789378515748,"field":"cvss","old":"8.1","new":null},{"seq":193954,"id":"CVE-2026-56858","ts":1789378515748,"field":"severity","old":"high","new":"none"},{"seq":192742,"id":"CVE-2026-56858","ts":1789376407151,"field":"cvss","old":null,"new":"8.1"},{"seq":192741,"id":"CVE-2026-56858","ts":1789376407151,"field":"severity","old":"none","new":"high"},{"seq":191529,"id":"CVE-2026-56858","ts":1789373419704,"field":"cvss","old":"8.1","new":null},{"seq":191528,"id":"CVE-2026-56858","ts":1789373419704,"field":"severity","old":"high","new":"none"},{"seq":190314,"id":"CVE-2026-56858","ts":1789369300017,"field":"cvss","old":null,"new":"8.1"},{"seq":190313,"id":"CVE-2026-56858","ts":1789369300017,"field":"severity","old":"none","new":"high"},{"seq":189101,"id":"CVE-2026-56858","ts":1789368266974,"field":"cvss","old":"8.1","new":null},{"seq":189100,"id":"CVE-2026-56858","ts":1789368266974,"field":"severity","old":"high","new":"none"},{"seq":187884,"id":"CVE-2026-56858","ts":1789365143362,"field":"cvss","old":null,"new":"8.1"},{"seq":187883,"id":"CVE-2026-56858","ts":1789365143362,"field":"severity","old":"none","new":"high"},{"seq":186671,"id":"CVE-2026-56858","ts":1789363271415,"field":"cvss","old":"8.1","new":null},{"seq":186670,"id":"CVE-2026-56858","ts":1789363271415,"field":"severity","old":"high","new":"none"},{"seq":185457,"id":"CVE-2026-56858","ts":1789361101343,"field":"cvss","old":null,"new":"8.1"},{"seq":185456,"id":"CVE-2026-56858","ts":1789361101343,"field":"severity","old":"none","new":"high"},{"seq":184244,"id":"CVE-2026-56858","ts":1789358155676,"field":"cvss","old":"8.1","new":null},{"seq":184243,"id":"CVE-2026-56858","ts":1789358155676,"field":"severity","old":"high","new":"none"},{"seq":182495,"id":"CVE-2026-56858","ts":1789354222481,"field":"cvss","old":null,"new":"8.1"},{"seq":182494,"id":"CVE-2026-56858","ts":1789354222481,"field":"severity","old":"none","new":"high"},{"seq":181288,"id":"CVE-2026-56858","ts":1789353120618,"field":"cvss","old":"8.1","new":null},{"seq":181287,"id":"CVE-2026-56858","ts":1789353120618,"field":"severity","old":"high","new":"none"},{"seq":180081,"id":"CVE-2026-56858","ts":1789350169133,"field":"cvss","old":null,"new":"8.1"},{"seq":180080,"id":"CVE-2026-56858","ts":1789350169133,"field":"severity","old":"none","new":"high"},{"seq":178874,"id":"CVE-2026-56858","ts":1789348101426,"field":"cvss","old":"8.1","new":null},{"seq":178873,"id":"CVE-2026-56858","ts":1789348101426,"field":"severity","old":"high","new":"none"},{"seq":177667,"id":"CVE-2026-56858","ts":1789346277631,"field":"cvss","old":null,"new":"8.1"},{"seq":177666,"id":"CVE-2026-56858","ts":1789346277631,"field":"severity","old":"none","new":"high"},{"seq":176460,"id":"CVE-2026-56858","ts":1789343018789,"field":"cvss","old":"8.1","new":null},{"seq":176459,"id":"CVE-2026-56858","ts":1789343018789,"field":"severity","old":"high","new":"none"},{"seq":174577,"id":"CVE-2026-56858","ts":1789334771626,"field":"cvss","old":null,"new":"8.1"},{"seq":174576,"id":"CVE-2026-56858","ts":1789334771626,"field":"severity","old":"none","new":"high"},{"seq":173372,"id":"CVE-2026-56858","ts":1789333512552,"field":"cvss","old":"8.1","new":null},{"seq":173371,"id":"CVE-2026-56858","ts":1789333512552,"field":"severity","old":"high","new":"none"},{"seq":172186,"id":"CVE-2026-56858","ts":1789331018058,"field":"cvss","old":null,"new":"8.1"},{"seq":172185,"id":"CVE-2026-56858","ts":1789331018058,"field":"severity","old":"none","new":"high"},{"seq":171000,"id":"CVE-2026-56858","ts":1789328614603,"field":"cvss","old":"8.1","new":null},{"seq":170999,"id":"CVE-2026-56858","ts":1789328614603,"field":"severity","old":"high","new":"none"},{"seq":169795,"id":"CVE-2026-56858","ts":1789327051008,"field":"cvss","old":null,"new":"8.1"},{"seq":169794,"id":"CVE-2026-56858","ts":1789327051008,"field":"severity","old":"none","new":"high"}]}