CVE-2026-56858
published 2026-08-13CVE-2026-56858: Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.31%
22.6th percentile
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Affected
89 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-operator-bundle | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| albo | aws-load-balancer-controller-rhel8 | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-selinuxd-rhel8 | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubemacpool-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| cryostat | cryostat-storage-rhel9 | — | — |
| custom-metrics-autoscaler | custom-metrics-autoscaler-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| devworkspace | devworkspace-rhel9-operator | — | — |
| dvo | deployment-validation-rhel8-operator | — | — |
| etcd | etcd | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
ghsa_unreviewed·2026-08-14
CVE-2026-56858 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
VulDB
Google html-template up to 1.25.12/1.26.5 cross site scripting
vuldb·2026-08-14
CVE-2026-56858 [LOW] Google html-template up to 1.25.12/1.26.5 cross site scripting
A vulnerability has been found in Google html-template up to 1.25.12/1.26.5 and classified as problematic. This vulnerability affects unknown code. Performing a manipulation results in cross site scripting.
This vulnerability is identified as CVE-2026-56858. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
Red Hat
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
vendor_redhat·2026-08-13·CVSS 6.1
CVE-2026-56858 [MEDIUM] CWE-79 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.
Package: rhai/assisted-installer-rhel9 (Assisted Installer for Red Hat OpenShift Container Platform 2) - Affected
Package: albo/aws-load-balancer-controller-rhel8 (AWS Load Balancer Operator) - Affected
Package: openshift-builds/openshift-builds-waiters-rhel9 (Builds for Red Hat OpenShift) - Affected
Package: cert-manager/jetstack-cert-manager-rhel9 (cert-manage
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56858 delve: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
bugzilla·2026-09-11·CVSS 6.1
CVE-2026-56858 [MEDIUM] CVE-2026-56858 delve: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
CVE-2026-56858 delve: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Bugzilla
CVE-2026-56858 rhc: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
bugzilla·2026-09-11·CVSS 6.1
CVE-2026-56858 [MEDIUM] CVE-2026-56858 rhc: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
CVE-2026-56858 rhc: Go html/template: Cross-Site Scripting via pathological input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Bugzilla
CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
bugzilla·2026-08-13·CVSS 6.1
CVE-2026-56858 [MEDIUM] CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
2026-08-13
Published