Medium · 6.1 CVE-2026-39826 BIT-golang-2026-39826EUVD-2026-28426GHSA-3v2c-x6q9-f697GO-2026-4980

Escaper bypass leads to XSS in html/template

Published May 7, 2026 · Updated May 8, 2026 · Assigned by Go

Vendor: Go standard library Product: html/template Package: aactl Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: amazon-k8s-cni Package: apache-exporter Package: apko Package: argo-cd-3.3-compat Package: argo-events Package: argo-workflow-controller-4.0 Package: argo-workflow-executor-3.7 Package: argo-workflow-executor-4.0 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: atlantis Package: authservice Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: aws-otel-collector Package: azure-service-operator Package: buildah Package: buildctl Package: buildkitd Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-csi-driver Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: certificate-transparency-trillian-ctserver Package: cilium-cli Package: cloud-provider-azure-cloud-controller-manager-1.35 Package: cloud-provider-azure-cloud-node-manager-1.35 Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.21 Package: cloudnative-pg Package: cloudnative-pg-plugins Package: cni-plugins Package: cni-plugins-aws-k8s-compat Package: cni-plugins-dhcp Package: cni-plugins-ipam Package: cni-plugins-main Package: cni-plugins-meta Package: conftest Package: consul-k8s-1.9 Package: consul-k8s-1.9-cli Package: container-object-storage-interface-sidecar Package: containerd-1 Package: containerd-shim-runc-v2-1 Package: containerd-stress-1 Package: coredns-1.13 Package: cortex Package: crossplane-2.2 Package: crossplane-2.2-crank Package: ctr-1 Package: dagger Package: dask-gateway-server Package: datadog-agent-7.72-full Package: datadog-agent-7.73-full Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: dbmate Package: dex Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: falco-no-driver Package: fluent-bit-plugin-loki Package: flux-2.7 Package: flyte Package: gatekeeper-3.22 Package: gatekeeper-3.22-gator Package: gatus Package: gitaly-18.11 Package: gitlab-pages-18.11 Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: goreleaser Package: gosh Package: gpu-feature-discovery Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-metaconvert-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-mimir-3.0-query-tee-3.0 Package: grafana-pyroscope-1.19 Package: guac Package: guacingest Package: guacone Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: helm-3 Package: helm-operator Package: hubble Package: jitsucom-bulker-bulker Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-syncctl Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3s Package: k3s-1.32 Package: k3s-1.35 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-multicall-1.34 Package: k3s-multicall-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.35 Package: k8sgpt Package: kaf Package: karma Package: katib-controller Package: katib-db-manager Package: katib-file-metricscollector Package: katib-suggestion-goptuna Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-webhook Package: knative-serving-1.21-activator Package: ko Package: kots Package: kpt Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-logging-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-bash-completion-1.35 Package: kubeflow-profile-controller Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubo Package: kuma-cni-2.12 Package: kuma-coredns-1.13 Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kuma-install-cni-2.12 Package: kumactl-2.12 Package: kyverno-1.17 Package: kyverno-cli-1.17 Package: lazydocker Package: libnvidia-container Package: litestream Package: lvm-driver Package: mattermost-11.1 Package: mattermost-11.7 Package: mc Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metrics-server Package: migrate Package: minio Package: minio-object-browser Package: nerdctl Package: no-docs-check Package: nuclei Package: nvidia-device-plugin Package: octo-sts Package: octo-sts-webhook Package: opencost Package: otel-cli Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-pushgateway Package: rabbitmq-cluster-operator Package: ratify Package: rclone Package: redka Package: runc Package: scorecard Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-azure Package: secrets-store-csi-driver-provider-gcp Package: sftpgo Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-pubsub Package: skopeo Package: slsa-verifier Package: sops Package: splunk-otel-collector Package: spqr Package: stdlib Package: step Package: step-ca Package: step-issuer Package: symlink-check Package: tdbg Package: tekton-chains Package: tekton-pipelines-entrypoint-1.12 Package: tekton-pipelines-events-1.12 Package: tekton-pipelines-resolvers-1.11 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-sidecarlogresults-1.12 Package: tekton-pipelines-webhook-1.11 Package: tekton-pipelines-webhook-1.12 Package: teleport-18.6 Package: teleport-18.6-kube-agent-updater Package: teleport-18.6-operator Package: tempo-2.10 Package: tempo-2.10-cli Package: tempo-2.10-query Package: tempo-2.10-vulture Package: temporal-cassandra-tool Package: temporal-elasticsearch-tool Package: temporal-server Package: temporal-sql-tool Package: terraform-provider-acme Package: terraform-provider-pagerduty Package: terraform-provider-tls Package: tetra Package: tetragon Package: tetragon-operator Package: thanos Package: timestamp-authority-server Package: tkn Package: trino Package: tw Package: twt Package: undock Package: vault-benchmark Package: vault-secrets-webhook Package: vitess-23 Package: vitess-23-binaries Package: xeol Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Affected products

Vendor	Product	Affected	Fixed
Go standard library	html/template	< 1.25.10, 1.26.0-0 – < 1.26.3	1.25.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-1.26	1.26.3-1	—
Debian 13	golang-1.24	No fix yet	—
Debian 12	golang-1.19	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	golang-1.23 +2	No fix yet	—
Ubuntu 25.10	golang-1.23 +2	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 20.04 LTS	golang-1.13 +5	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-1.8 +2	No fix yet	—
Ubuntu 16.04 LTS	golang-1.6 +1	No fix yet	—
Ubuntu 14.04 LTS	golang-1.10	No fix yet	—
Ubuntu Pro 22.04 LTS	golang-1.13	No fix yet	—
Ubuntu Pro 20.04 LTS	golang-1.16	No fix yet	—
Ubuntu Pro 18.04 LTS	golang-1.13 +2	No fix yet	—
Ubuntu Pro 16.04 LTS	golang-1.13 +1	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	golang +7	1.26.3-4.el10_2	RHSA-2026:22120
RHEL 9	golang +7	1.26.3-1.el9_8	RHSA-2026:22121
RHEL 8	delve	1.25.2-1.module+el8.10.0+23746+9db33b5e	RHSA-2026:22112
RHEL 8	golang +7	1.25.10-1.module+el8.10.0+24308+5c4a16b7	RHSA-2026:22112

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	golang +7	1.26.5-1.el10_0	RHSA-2026:49702
RHEL 9.6 EUS	golang +7	1.26.5-1.el9_6	RHSA-2026:49712
RHEL 9.4 E4S	golang +7	1.26.5-1.el9_4	RHSA-2026:57649
RHEL 9.2 E4S	golang +7	1.26.5-1.el9_2	RHSA-2026:61253
Red Hat Hardened Images 1	golang1.25 +5	1.25.11-2.hum1	RHSA-2026:23262
Red Hat Hardened Images 1	golang1.26 +5	1.26.4-2.hum1	RHSA-2026:23264

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	golang +7	1.26.3-1.el9_8	ALSA-2026:22121
AlmaLinux 8	delve	1.25.2-1.module_el8.10.0+4074+24330916	ALSA-2026:22112
AlmaLinux 8	golang +7	1.25.10-1.module_el8.10.0+4187+c45165c4	ALSA-2026:22112

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	golang	1.26.3-4.el10_2	RLSA-2026:22120
Rocky Linux 9	golang	1.26.3-1.el9_8	RLSA-2026:22121
Rocky Linux 8	delve	1.25.2-1.module+el8.10.0+40035+ee0a7047	RLSA-2026:22112
Rocky Linux 8	golang	1.25.10-1.module+el8.10.0+40200+0fd0f175	RLSA-2026:22112

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES for SAP 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1
SLES 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	go1.25	1.25.10-1.1	openSUSE-SU-2026:10723-1
openSUSE Tumbleweed	go1.26	1.26.3-1.1	openSUSE-SU-2026:10741-1
openSUSE Leap 16.0	go1.25-openssl	1.25.12-160000.1.1	openSUSE-SU-2026:21319-1
openSUSE Leap 16.0	go1.26-openssl	1.26.4-160000.1.1	openSUSE-SU-2026:21254-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1	openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	go	1.26.3-r0	—
Alpine v3.24	rclone	1.74.1-r0	—
Alpine v3.23	go	1.25.10-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-cloudwatch-agent	1.300066.2-2.amzn2023	ALAS2023-2026-1747
Amazon Linux 2023	amazon-ecr-credential-helper	0.12.0-3.amzn2023	ALAS2023-2026-1738
Amazon Linux 2023	containerd +1	2.2.3-1.amzn2023.0.2	ALAS2023-2026-1737
Amazon Linux 2023	credentials-fetcher	2.0.1-1.amzn2023.0.5	ALAS2023-2026-1744
Amazon Linux 2023	docker	25.0.14-1.amzn2023.0.6	ALAS2023-2026-1736
Amazon Linux 2023	ecs-init	1.103.2-1.amzn2023	ALAS2023-2026-1771
Amazon Linux 2023	golang +6	1.25.10-1.amzn2023.0.1	ALAS2023-2026-1743
Amazon Linux 2023	golang-github-burntsushi-toml +1	1.5.0-1.amzn2023.0.1	ALAS2023-2026-1751
Amazon Linux 2023	golang-github-burntsushi-toml-test +1	0.2.0-8.amzn2023.0.3	ALAS2023-2026-1750
Amazon Linux 2023	golang-github-cpuguy83-md2man +2	2.0.2-24.amzn2023.0.7	ALAS2023-2026-1749
Amazon Linux 2023	golist	0.10.4-12.amzn2023.0.9	ALAS2023-2026-1742
Amazon Linux 2023	nerdctl	2.2.2-1.amzn2023.0.2	ALAS2023-2026-1735
Amazon Linux 2023	oci-add-hooks	0-0.1.20200504git268e3bb.amzn2023.0.11	ALAS2023-2026-1739
Amazon Linux 2023	runc	1.3.4-5.amzn2023.0.2	ALAS2023-2026-1715
Amazon Linux 2023	runfinch-finch	1.17.0-1.amzn2023.0.2	ALAS2023-2026-1741
Amazon Linux 2023	soci-snapshotter	0.13.0-1.amzn2023.0.3	ALAS2023-2026-1740
Amazon Linux 2	amazon-cloudwatch-agent	1.300066.2-2.amzn2	ALAS2-2026-3323
Amazon Linux 2	golang +6	1.25.10-1.amzn2.0.1	ALAS2-2026-3313
Amazon Linux 2	golist	0.10.1-10.amzn2.0.13	ALAS2-2026-3308
Amazon Linux 2	nerdctl	2.2.2-1.amzn2.0.2	ALAS2-2026-3319

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	golang	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	golang +7	1.26.5-1.0.1.el10_2	ELSA-2026-22120
Oracle Linux 9	golang +7	1.26.3-1.0.1.el9_8	ELSA-2026-22121
Oracle Linux 8	delve	1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd	ELSA-2026-22112
Oracle Linux 8	golang +7	1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb	ELSA-2026-22112

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	aactl	0.4.12-r50	—
Wolfi rolling	amazon-cloudwatch-agent	1.300067.0-r2	—
Wolfi rolling	amazon-cloudwatch-agent-operator	3.4.2-r2	—
Wolfi rolling	amazon-k8s-cni	1.21.1-r6	—
Wolfi rolling	apache-exporter	1.0.12-r6	—
Wolfi rolling	apko	1.2.11-r1	—
Wolfi rolling	argo-cd-3.3-compat	3.3.9-r2	—
Wolfi rolling	argo-events	1.9.10-r18	—
Wolfi rolling	argo-workflows-3.7 +1	3.7.14-r1	—
Wolfi rolling	argo-workflows-4.0 +2	4.0.5-r2	—
Wolfi rolling	atlantis	0.43.0-r0	—
Wolfi rolling	authservice	1.1.5-r8	—
Wolfi rolling	aws-flb-cloudwatch	1.9.5-r1	—
Wolfi rolling	aws-flb-firehose	1.7.3-r1	—
Wolfi rolling	aws-flb-kinesis	1.10.4-r1	—
Wolfi rolling	aws-otel-collector	0.47.0-r12	—
Wolfi rolling	azure-service-operator	2.19.0-r0	—
Wolfi rolling	buildah	1.43.1-r2	—
Wolfi rolling	buildctl	0.29.0-r9	—
Wolfi rolling	buildkitd	0.29.0-r8	—
Wolfi rolling	cert-manager-1.20 +5	1.20.2-r3	—
Wolfi rolling	cert-manager-csi-driver	0.14.0-r3	—
Wolfi rolling	certificate-transparency-trillian-ctserver	1.3.3-r9	—
Wolfi rolling	cilium-cli	0.19.2-r11	—
Wolfi rolling	cloud-provider-azure-cloud-node-manager-1.35 +1	1.35.3-r5	—
Wolfi rolling	cloud-sql-proxy-2.16	2.16.0-r21	—
Wolfi rolling	cloud-sql-proxy-2.21	2.21.3-r2	—
Wolfi rolling	cloudnative-pg +1	1.29.0-r8	—
Wolfi rolling	cni-plugins +4	1.9.1-r4	—
Wolfi rolling	cni-plugins-main	1.9.1-r3	—
Wolfi rolling	conftest	0.68.2-r3	—
Wolfi rolling	consul-k8s-1.9 +1	1.9.7-r2	—
Wolfi rolling	container-object-storage-interface-sidecar	0.2.2-r14	—
Wolfi rolling	coredns-1.13 +1	1.13.2-r5	—
Wolfi rolling	cortex	1.21.0-r2	—
Wolfi rolling	crossplane-2.2 +1	2.2.1-r0	—
Wolfi rolling	ctr-1 +3	1.7.31-r2	—
Wolfi rolling	dagger	0.20.8-r1	—
Wolfi rolling	dask-gateway-server	2026.3.0-r4	—
Wolfi rolling	datadog-agent-7.72-full	7.72.4-r22	—
Wolfi rolling	datadog-agent-7.73-full +1	7.73.3-r13	—
Wolfi rolling	dbmate	2.33.0-r1	—
Wolfi rolling	dex	2.45.1-r9	—
Wolfi rolling	dockerd-29	29.4.3-r0	—
Wolfi rolling	dogstatsd-7.72 +1	7.72.4-r21	—
Wolfi rolling	dogstatsd-7.73	7.73.3-r12	—
Wolfi rolling	falco-no-driver	0.44.0-r0	—
Wolfi rolling	fluent-bit-plugin-loki	3.7.1-r5	—
Wolfi rolling	flux-2.7	2.7.5-r16	—
Wolfi rolling	flyte	1.16.6-r0	—
Wolfi rolling	gatekeeper-3.22 +1	3.22.2-r1	—
Wolfi rolling	gatus	5.35.0-r12	—
Wolfi rolling	gitaly-18.11	18.11.2-r1	—
Wolfi rolling	gitlab-pages-18.11	18.11.2-r0	—
Wolfi rolling	go-1.24	1.24.13-r0	—
Wolfi rolling	go-1.24-nm +5	No fix yet	—
Wolfi rolling	go-1.26	1.26.3-r0	—
Wolfi rolling	goreleaser	2.15.4-r1	—
Wolfi rolling	gosh	0.0.47-r0	—
Wolfi rolling	gpu-feature-discovery	0.19.1-r1	—
Wolfi rolling	grafana-12.3	12.3.6.01-r5	—
Wolfi rolling	grafana-12.4	12.4.2-r11	—
Wolfi rolling	grafana-13.0	13.0.1-r3	—
Wolfi rolling	grafana-alloy	1.15.1-r5	—
Wolfi rolling	grafana-mimir-3.0 +2	3.0.6-r2	—
Wolfi rolling	grafana-mimir-3.0-metaconvert-3.0	3.0.6-r3	—
Wolfi rolling	grafana-pyroscope-1.19	1.19.3-r3	—
Wolfi rolling	guac +2	1.1.0-r7	—
Wolfi rolling	harbor-2.14 +1	2.14.3-r16	—
Wolfi rolling	harbor-2.14-exporter +1	2.14.3-r15	—
Wolfi rolling	helm-3	3.20.2-r0	—
Wolfi rolling	helm-operator	1.42.2-r5	—
Wolfi rolling	hubble	1.19.3-r2	—
Wolfi rolling	jitsucom-bulker-bulker +4	2.11.913-r25	—
Wolfi rolling	juicefs-1.3	1.3.1-r14	—
Wolfi rolling	k3d	5.8.3-r33	—
Wolfi rolling	k3d-proxy	5.8.3-r32	—
Wolfi rolling	k3s +1	1.35.3.1-r7	—
Wolfi rolling	k3s-1.32 +1	1.32.13.1-r16	—
Wolfi rolling	k3s-1.35 +2	1.35.3.1-r5	—
Wolfi rolling	k3s-multicall-1.34	1.34.6.1-r6	—
Wolfi rolling	k3s-static	1.35.3.1-r8	—
Wolfi rolling	k3s-static-1.32	1.32.13.1-r15	—
Wolfi rolling	k8sgpt	0.4.33-r0	—
Wolfi rolling	kaf	0.2.14-r3	—
Wolfi rolling	karma	0.129-r3	—
Wolfi rolling	katib-controller +1	0.19.0-r14	—
Wolfi rolling	katib-suggestion-goptuna +1	0.19.0-r15	—
Wolfi rolling	keda-2.19 +1	2.19.0-r13	—
Wolfi rolling	knative-eventing-1.21-jobsink +1	1.21.4-r10	—
Wolfi rolling	knative-serving-1.21-activator	1.21.3-r7	—
Wolfi rolling	ko	0.18.1-r14	—
Wolfi rolling	kots	1.130.2-r1	—
Wolfi rolling	kpt	1.0.0_beta55-r20	—
Wolfi rolling	kube-arangodb-1.4	1.4.3-r2	—
Wolfi rolling	kube-fluentd-operator	1.18.2-r63	—
Wolfi rolling	kube-logging-operator	6.5.0-r2	—
Wolfi rolling	kube-proxy-1.35 +1	1.35.4-r4	—
Wolfi rolling	kube-proxy-1.36 +1	1.36.0-r0	—
Wolfi rolling	kubeadm-1.34 +3	1.34.7-r1	—
Wolfi rolling	kubeadm-1.35 +5	1.35.4-r3	—
Wolfi rolling	kubeadm-1.36 +5	1.36.0-r1	—
Wolfi rolling	kubectl-1.32	1.32.13-r1	—
Wolfi rolling	kubectl-1.33	1.33.11-r1	—
Wolfi rolling	kubectl-1.34 +3	1.34.7-r2	—
Wolfi rolling	kubectl-bash-completion-1.35 +3	1.35.8-r6	—
Wolfi rolling	kubeflow-profile-controller	1.10.0-r21	—
Wolfi rolling	kubernetes-csi-driver-nfs	4.13.2-r3	—
Wolfi rolling	kubernetes-csi-external-attacher	4.11.0-r9	—
Wolfi rolling	kubernetes-dashboard	7.14.0-r6	—
Wolfi rolling	kubevela-vela-cli +1	1.10.8-r5	—
Wolfi rolling	kubo	0.41.0-r1	—
Wolfi rolling	kuma-cp-2.12 +4	2.12.3-r14	—
Wolfi rolling	kyverno-1.17 +1	1.17.2-r35	—
Wolfi rolling	lazydocker	0.25.2-r1	—
Wolfi rolling	libnvidia-container	1.19.0-r1	—
Wolfi rolling	litestream	0.5.11-r2	—
Wolfi rolling	lvm-driver	1.8.1-r9	—
Wolfi rolling	mattermost-11.1	11.1.3-r2	—
Wolfi rolling	mattermost-11.7	11.7.0-r1	—
Wolfi rolling	mc	0.20250813.083541-r12	—
Wolfi rolling	mesosphere-vsphere-csi-driver +1	3.5.0-r17	—
Wolfi rolling	metrics-server	0.8.1-r6	—
Wolfi rolling	migrate	4.19.1-r12	—
Wolfi rolling	minio	0.20260504.002721-r1	—
Wolfi rolling	minio-object-browser	2.0.4-r12	—
Wolfi rolling	nerdctl	2.2.2-r5	—
Wolfi rolling	nuclei	3.8.0-r3	—
Wolfi rolling	nvidia-device-plugin	0.19.1-r0	—
Wolfi rolling	octo-sts +1	0.7.0-r0	—
Wolfi rolling	opencost	1.120.1-r1	—
Wolfi rolling	otel-cli	0.4.5-r21	—
Wolfi rolling	prometheus-3.10	3.10.0-r6	—
Wolfi rolling	prometheus-3.11	3.11.3-r0	—
Wolfi rolling	prometheus-3.8	3.8.1-r4	—
Wolfi rolling	prometheus-3.9	3.9.1-r4	—
Wolfi rolling	prometheus-adapter	0.12.0-r25	—
Wolfi rolling	prometheus-config-reloader	0.91.0-r0	—
Wolfi rolling	prometheus-operator +1	0.91.0-r1	—
Wolfi rolling	prometheus-pushgateway	1.11.2-r10	—
Wolfi rolling	rabbitmq-cluster-operator	2.20.1-r0	—
Wolfi rolling	ratify	1.4.0-r27	—
Wolfi rolling	redka	1.0.1-r1	—
Wolfi rolling	runc	1.4.2-r2	—
Wolfi rolling	scorecard	5.5.0-r1	—
Wolfi rolling	secrets-store-csi-driver	1.6.0-r0	—
Wolfi rolling	secrets-store-csi-driver-provider-azure	1.7.2-r14	—
Wolfi rolling	secrets-store-csi-driver-provider-gcp	1.12.0-r4	—
Wolfi rolling	sftpgo	2.7.1-r9	—
Wolfi rolling	sftpgo-plugin-auth	1.0.14-r7	—
Wolfi rolling	sftpgo-plugin-eventstore	1.0.23-r5	—
Wolfi rolling	sftpgo-plugin-geoipfilter	1.0.12-r5	—
Wolfi rolling	sftpgo-plugin-pubsub	1.0.16-r6	—
Wolfi rolling	skopeo	1.22.2-r1	—
Wolfi rolling	slsa-verifier	2.7.1-r16	—
Wolfi rolling	sops	3.12.2-r4	—
Wolfi rolling	splunk-otel-collector	0.150.0-r0	—
Wolfi rolling	spqr	2.9.0-r7	—
Wolfi rolling	step	0.30.2-r5	—
Wolfi rolling	step-ca	0.30.2-r7	—
Wolfi rolling	step-issuer	0.10.2-r10	—
Wolfi rolling	tdbg +4	1.31.0-r0	—
Wolfi rolling	tekton-chains	0.26.3-r1	—
Wolfi rolling	tekton-pipelines-events-1.12 +2	1.12.0-r1	—
Wolfi rolling	tekton-pipelines-resolvers-1.12 +1	1.12.0-r0	—
Wolfi rolling	tekton-pipelines-webhook-1.11 +1	1.11.1-r20	—
Wolfi rolling	teleport-18.6 +2	18.6.8-r13	—
Wolfi rolling	tempo-2.10 +1	2.10.5-r1	—
Wolfi rolling	tempo-2.10-cli +1	2.10.5-r2	—
Wolfi rolling	terraform-provider-acme	2.48.1-r1	—
Wolfi rolling	terraform-provider-pagerduty	3.32.4-r0	—
Wolfi rolling	terraform-provider-tls	4.2.1-r10	—
Wolfi rolling	tetra +1	1.6.0-r8	—
Wolfi rolling	tetragon-operator	1.6.0-r9	—
Wolfi rolling	thanos	0.41.0-r11	—
Wolfi rolling	timestamp-authority-server	2.0.6-r0	—
Wolfi rolling	tkn	0.44.1-r5	—
Wolfi rolling	trino	480-r15	—
Wolfi rolling	tw +3	0.0.47-r1	—
Wolfi rolling	undock	0.13.0-r1	—
Wolfi rolling	vault-benchmark	0.4.0-r15	—
Wolfi rolling	vault-secrets-webhook	1.22.2-r14	—
Wolfi rolling	vitess-23	23.0.4-r0	—
Wolfi rolling	vitess-23-binaries	23.0.4-r1	—
Wolfi rolling	xeol	0.10.8-r37	—
Wolfi rolling	zarf	0.75.1-r0	—
Wolfi rolling	zot	2.1.16-r3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.25.10 · >= 1.26.0-0, < 1.26.3	1.25.10, 1.26.3	GO-2026-4980

Advisories 47

WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-1437 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2026:22121 Important: golang security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:22112 Important: go-toolset:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:61253 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:57649 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49712 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49702 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:23264 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:23262 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22120 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22121 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22112 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RLSA-2026:22112 Important: go-toolset:rhel8 security update Rocky Linux Security Advisories · Aug 26, 2026
RLSA-2026:22120 Important: golang security update Rocky Linux Security Advisories · Aug 26, 2026
RLSA-2026:22121 Important: golang security update Rocky Linux Security Advisories · Aug 26, 2026
openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
ELSA-2026-22120 Important: golang security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 21, 2026
SUSE-SU-2026:22638-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 17, 2026
openSUSE-SU-2026:21319-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
SUSE-SU-2026:22572-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:21254-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 9, 2026
ALAS2023-2026-1747 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ALAS2-2026-3323 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ELSA-2026-22121 Important: golang security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
ELSA-2026-22112 Important: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 2, 2026
ALAS2-2026-3308 Important: golist security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2-2026-3313 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2-2026-3319 Important: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1741 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1742 Important: golist security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1715 Important: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1735 Important: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1743 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1736 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1744 Important: credentials-fetcher security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1737 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1738 Important: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1749 Important: golang-github-cpuguy83-md2man security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1739 Important: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1750 Important: golang-github-burntsushi-toml-test security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1740 Important: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1751 Important: golang-github-burntsushi-toml security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
ALAS2023-2026-1771 Important: ecs-init security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
openSUSE-SU-2026:10741-1 go1.26-1.26.3-1.1 on GA media SUSE / openSUSE Security Updates · May 11, 2026
openSUSE-SU-2026:10723-1 go1.25-1.25.10-1.1 on GA media SUSE / openSUSE Security Updates · May 9, 2026

EUVD	v3.1	6.1
CISA-ADP	v3.1	6.1

Escaper bypass leads to XSS in html/template

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 47

References