Live › vulnerability › CVE-2026-97030
Go to dashboardGo's html/template standard library package did not treat the 'yield' keyword as a regexp-preceding keyword, so some template output could be escaped incorrectly. The sources describe this as requiring a trusted template author, so an attacker mainly gains a possible escaping bypass in templates that are already trusted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
go version and check that the go.mod go directive and the toolchain in use are not in the affected range (>= 1.27.0-0, < 1.27.2 or < 1.26.9 on the 1.26 line)go list -m all or govulncheck ./... to see whether the stdlib module is used by your buildUpgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.
We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
This page as .md · .json · in your agent: get_signal("CVE-2026-97030")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.