Template Escaping Flaw in Go's HTML Package Affects Trusted Template Authors

CVE-2026-97030

What is CVE-2026-97030?

A flaw exists in the HTML package where the 'yield' keyword used in templates may not have been correctly escaped. This vulnerability affects trusted template authors, as it allows for potential exploitation if valid keyword usages are not properly handled. The current fix ensures that valid uses of the 'yield' keyword are escaped correctly, while non-keyword uses remain unaffected, enhancing the overall security of template rendering in Go applications.

References