CVE-2026-56858

Received Received - Intake

Path Traversal in Go Standard Library

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: Go Project

Description

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-56858

EUVD

EUVD-2026-58512

Affected Vendors & Products

Vendor	Product	Version / Range
golang	html_template	From go1.27.0 (inc) to go1.27.0-rc.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw where improper handling of a forward slash character (/) in inputs could allow an attacker to prematurely close an escape sequence. This enables injection of arbitrary malicious content, which could lead to cross-site scripting (XSS) attacks.

Detection Guidance

To detect this vulnerability, check your Go version against affected releases (html/template before go1.25.13, go1.26.0-0 to go1.26.5, or go1.27.0-0 to go1.27.0-rc.2). Use commands like 'go version' to verify. Inspect applications using html/template for JavaScript regexp literal sinks in script blocks after top-level curly braces.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. This may result in unauthorized access to user sessions, theft of sensitive data, or defacement of websites.

Compliance Impact

This vulnerability could potentially lead to Cross-Site Scripting (XSS) attacks, which may expose sensitive user data. This could impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized data access or breaches.

Mitigation Strategies

Update to the latest version of Go where this issue has been patched. Review and sanitize any user-controlled input that may be processed by Go's templating or HTML escaping functions.

Hi! I’m here to help you understand CVE-2026-56858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70