CVE-2026-56858

Received Received - Intake

Path Traversal in Go Standard Library

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56858

EUVD

EUVD-2026-58512

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw where improper handling of a forward slash character (/) in inputs could allow an attacker to prematurely close an escape sequence. This enables injection of arbitrary malicious content, which could lead to cross-site scripting (XSS) attacks.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. This may result in unauthorized access to user sessions, theft of sensitive data, or defacement of websites.

Mitigation Strategies

Update to the latest version of Go where this issue has been patched. Review and sanitize any user-controlled input that may be processed by Go's templating or HTML escaping functions.

Hi! I’m here to help you understand CVE-2026-56858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70