CVE-2026-97030

Received Received - Intake

Yield Keyword Misinterpretation in Go Templates

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-97030

EUVD

EUVD-2026-95416

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library html/template 0
Go	standard	library html/template 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Go's html/template package where the 'yield' keyword in templates may not be correctly escaped by trusted authors. The issue ensures that valid uses of 'yield' are now properly escaped while invalid uses are not.

Impact Analysis

An attacker could exploit this to inject malicious scripts or content into web pages rendered by affected Go applications using the html/template package, potentially leading to cross-site scripting (XSS) attacks.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Update to the latest version of Go where this issue is patched. Review templates using the 'yield' keyword in html/template to ensure proper escaping. Test affected applications after updating.

Hi! I’m here to help you understand CVE-2026-97030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70