CVE-2026-39826Medium· 5.4▾ Sunlit

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 29.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 7, 2026

Updated

Sep 8, 2026

CVSS

5.4

Vendor

Red Hat

Product

Red Hat OpenShift Container Platform 4

CWE

CWE-1289

Depth score

30 · Low

EPSS

0.37% · p31

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 26.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

9 events · 125 days

May 7, 2026Published
Disclosed via CSAF
Aug 26, 2026EPSS first tracked
0.4%
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026CVSS changed
— → 5.4
Sep 8, 2026Severity changed
none → medium
Sep 8, 2026CVSS changed
5.4 → —
Sep 8, 2026Severity changed
medium → none
Sep 8, 2026CVSS changed
— → 5.4
Sep 8, 2026Severity changed
none → medium

Red Hat CWE-1289 #csaf #vex #red-hat #osv #go

Affected

Patched in

enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_e4s_v_9_2
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
openshift_api_for_data_protection 1.6
hardened_images
multicluster_engine_for_kubernetes 2.11

Full technical detail▾

Overview

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.

Vendor advisories

RHSA-2026:49702 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-03 · advisory
RHSA-2026:22120 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-01 · advisory
RHSA-2026:22112 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · advisory
RHSA-2026:61253 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · advisory
RHSA-2026:57649 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-20 · advisory
RHSA-2026:49712 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-03 · advisory
RHSA-2026:22121 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · advisory
RHSA-2026:43692 · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · advisory
RHSA-2026:23262 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:23264 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:57194 · Red Hat · fixed in: multicluster engine for Kubernetes 2.11 · released 2026-08-19 · advisory
Red Hat VEX · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, … · updated 2026-09-08 · vex

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-09-08.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
File Integrity Operator
Gatekeeper 3
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Fixed:

Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream E4S (v.9.2)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
OpenShift API for Data Protection 1.6
Red Hat Hardened Images
multicluster engine for Kubernetes 2.11

No fix planned:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
File Integrity Operator
Gatekeeper 3
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Not affected:

OpenShift API for Data Protection 1.6
multicluster engine for Kubernetes 2.11

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:49702 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-39826)

Affected packages:

stdlib >= 1.26.0-0, < 1.26.3

Patched in:

stdlib 1.26.3

Source: https://osv.dev/vulnerability/GO-2026-4980

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS — → 5.4
Sep 8, 2026Severity none → medium
Sep 8, 2026CVSS 5.4 → —
Sep 8, 2026Severity medium → none
Sep 8, 2026CVSS — → 5.4
Sep 8, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed