CVE-2026-97030: go standard library html/template Cross-site Scripting

CVSS: 6.1v3.1MediumAwaiting analysis

AliasesUBUNTU-CVE-2026-97030DEBIAN-CVE-2026-97030CGA-2228-vcxh-9p98+8828 more

Published 08-10-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-97030 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in go standard library html/template. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.20%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 9

MGASA-2026-0497 OPENSUSE-SU-2026:12093-1 OPENSUSE-SU-2026:12101-1 OPENSUSE-SU-2026:12112-1 OPENSUSE-SU-2026:22093-1 OPENSUSE-SU-2026:22095-1+4 more

Timeline

08-10-2026
PublishedVulnerability first disclosed.
15-10-2026
Last modifiedVulnerability information updated.

Description

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.1

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

Change unavailable

09-10-202621-10-2026

EPSS score

0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Chainguard200 products

aactl< 0.4.12-r79
access-log-exporter-fipsAll versions (No fix recorded)
acm-controller-fipsAll versions (No fix recorded)
actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)

addon-resizerAll versions (No fix recorded)
addon-resizer-fipsAll versions (No fix recorded)
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)
agentbeat-fips< 9.2.7-r30
agentbeat-fips-8.19< 8.19.23-r1
alloydb-auth-proxy-fips< 1.17.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300074.0-r2
amazon-cloudwatch-agent-operator-fips< 3.7.0-r8
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent-fips< 1.108.0-r1 | All versions (No fix recorded)
amazon-ecs-cni-plugins-fipsAll versions (No fix recorded)
amazon-eks-ami-fipsAll versions (No fix recorded)
amazon-k8s-cni-fipsAll versions (No fix recorded) | < 1.23.2-r1
amazon-k8s-cni-init-fipsAll versions (No fix recorded)
amazon-k8s-cni-init-fips-compat< 1.23.2-r2 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.5512.0-r1 | All versions (No fix recorded)
amazon-ssm-agent-fips< 3.3.5512.0-r1 | All versions (No fix recorded)
amazon-vpc-cni-pluginsAll versions (No fix recorded)
amazon-vpc-cni-plugins-fipsAll versions (No fix recorded)
ansible-operator-fips< 1.42.3-r17
apache-beam-java-11-sdk< 2.77.0-r1
apache-beam-java-17-sdkAll versions (No fix recorded) | < 2.77.0-r1
apache-beam-java-21-sdk< 2.77.0-r1
apache-beam-python-3.11-sdk< 2.77.0-r0
apache-beam-python-3.14-sdkAll versions (No fix recorded) | < 2.77.0-r1
apache-exporter< 1.1.1-r7
api-linter< 2.4.0-r1
apiserver-network-proxy-fips-0.34All versions (No fix recorded) | < 0.34.0-r15
apiserver-network-proxy-fips-0.34-agent< 0.34.0-r15
apiserver-network-proxy-fips-0.35< 0.35.0-r15 | All versions (No fix recorded)
apiserver-network-proxy-fips-0.35-agent< 0.35.0-r15
apiserver-network-proxy-fips-0.36< 0.36.0-r15
apiserver-network-proxy-fips-0.36-agentAll versions (No fix recorded) | < 0.36.0-r15
apiserver-network-proxy-fips-0.37All versions (No fix recorded) | < 0.37.0-r3
apiserver-network-proxy-fips-0.37-agent< 0.37.0-r3
apko-fips< 1.4.10-r1
apm-server-fips-8.19< 8.19.23-r2
apm-server-fips-9.2All versions (No fix recorded)
apm-server-fips-9.3All versions (No fix recorded)
apm-server-fips-9.4All versions (No fix recorded)
apm-server-fips-9.5All versions (No fix recorded)
application-gateway-kubernetes-ingress-fipsAll versions (No fix recorded)
argo-cd-3.3< 3.3.15-r1
argo-cd-3.3-compat< 3.3.15-r1
argo-cd-3.4< 3.4.10-r1
argo-cd-3.4-compat< 3.4.10-r1
argo-cd-fips-3.1< 3.1.16-r16
argo-cd-fips-3.1-compat< 3.1.16-r16
argo-cd-fips-3.2< 3.2.12-r27
argo-cd-fips-3.2-compat< 3.2.12-r27
argo-cd-fips-3.3< 3.3.15-r1
argo-cd-fips-3.3-compat< 3.3.15-r1
argo-cd-fips-3.4< 3.4.10-r1
argo-cd-fips-3.4-compat< 3.4.10-r1
argo-cd-fips-3.5< 3.5.4-r1
argo-cd-fips-3.5-compat< 3.5.4-r1
argo-events-fips< 1.9.11-r15
argo-rollouts-fipsAll versions (No fix recorded) | < 1.10.0-r4
argo-workflow-controller-3.7< 3.7.18-r10
argo-workflow-controller-4.0< 4.0.12-r2
argo-workflow-controller-4.1< 4.1.4-r2
argo-workflow-controller-fips-3.7< 3.7.18-r10
argo-workflow-controller-fips-4.0< 4.0.13-r1
argo-workflow-controller-fips-4.1< 4.1.4-r1 | < 4.1.5-r0
argo-workflow-executor-3.7< 3.7.18-r10
argo-workflow-executor-4.1< 4.1.5-r0
argo-workflow-executor-fips-3.7< 3.7.18-r10
argo-workflow-executor-fips-4.0< 4.0.13-r1
argo-workflow-executor-fips-4.1< 4.1.5-r0
argo-workflows-3.7< 3.7.18-r10
argo-workflows-4.0< 4.0.12-r2
argo-workflows-4.1< 4.1.4-r2
argo-workflows-fips-3.7< 3.7.18-r10
argo-workflows-fips-4.0< 4.0.13-r1
argo-workflows-fips-4.1< 4.1.5-r0 | < 4.1.4-r1
argocd-image-updater-fips< 1.3.1-r1
athenz-cert-manager-issuer-fipsAll versions (No fix recorded)
athenz-csi-driver-fips< 0.0.16-r9
athenz-csi-driver-fips-approverAll versions (No fix recorded)
atlantis< 0.48.1-r1
atlantis-fips< 0.48.1-r2
atlas< 1.3.0-r9
atlas-fips< 1.3.0-r11
auditbeat-9.3< 9.3.8-r17
auditbeat-fips-8.19< 8.19.23-r1
auditbeat-fips-9.2< 9.2.8-r25
auditbeat-fips-9.3All versions (No fix recorded)
auditbeat-fips-9.4All versions (No fix recorded)
auditbeat-fips-9.5All versions (No fix recorded)
authentik-2026.5-go-server< 2026.5.7-r10
authentik-fips-2025.12-go-server< 2025.12.6-r19
authentik-fips-2026.2-go-server< 2026.2.7-r6
authentik-fips-2026.5-go-server< 2026.5.7-r12
authservice< 1.1.8-r6
authservice-fips< 1.1.8-r7
avmfixAll versions (No fix recorded)
avmfix-fipsAll versions (No fix recorded)
aws-application-networking-k8sAll versions (No fix recorded)
aws-application-networking-k8s-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-1.58< 1.58.0-r15
aws-ebs-csi-driver-1.60< 1.60.1-r14
aws-ebs-csi-driver-1.61< 1.61.1-r10
aws-ebs-csi-driver-1.62< 1.62.0-r9
aws-ebs-csi-driver-1.63< 1.63.1-r8
aws-ebs-csi-driver-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r20 | < 1.57.1-r21
aws-ebs-csi-driver-fips-1.58< 1.58.0-r16
aws-ebs-csi-driver-fips-1.59< 1.59.0-r17
aws-ebs-csi-driver-fips-1.60< 1.60.1-r16
aws-ebs-csi-driver-fips-1.61< 1.61.1-r12
aws-ebs-csi-driver-fips-1.62< 1.62.0-r13 | All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.63< 1.63.1-r7
aws-ebs-csi-driver-fips-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.65< 1.65.0-r4
aws-ebs-csi-driver-fips-1.66< 1.66.1-r1
aws-efs-csi-driver-fips< 3.5.1-r3
aws-eks-pod-identity-agent-fipsAll versions (No fix recorded)
aws-flb-cloudwatchAll versions (No fix recorded)
aws-flb-cloudwatch-fipsAll versions (No fix recorded)
aws-flb-firehoseAll versions (No fix recorded)
aws-flb-firehose-fipsAll versions (No fix recorded)
aws-flb-kinesis-fipsAll versions (No fix recorded)
aws-for-fluent-bit-init-fipsAll versions (No fix recorded)
aws-fsx-csi-driver-fips< 1.11.0-r1
aws-iam-authenticator-fipsAll versions (No fix recorded)
aws-lambda-runtime-interface-emulator-fipsAll versions (No fix recorded)
aws-load-balancer-controller-fipsAll versions (No fix recorded)
aws-network-policy-agent< 1.4.3-r1 | All versions (No fix recorded)
aws-network-policy-agent-fips< 1.4.3-r1 | All versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fips< 1.25.6-r21
aws-nukeAll versions (No fix recorded)
aws-nuke-fipsAll versions (No fix recorded)
aws-otel-collector< 0.50.0-r6
aws-otel-collector-fips< 0.50.0-r7
aws-otel-collector-healthcheckAll versions (No fix recorded)
aws-otel-collector-healthcheck-fipsAll versions (No fix recorded)
aws-privateca-issuer-fipsAll versions (No fix recorded)
aws-signer-notation-plugin-fipsAll versions (No fix recorded)
aws-sigv4-proxy-fipsAll versions (No fix recorded)
azcopy-fipsAll versions (No fix recorded) | < 10.32.8-r4
azure-metrics-exporter< 25.12.0-r7
azure-metrics-exporter-fips< 25.12.0-r3
azure-service-operator< 2.21.1-r2
azure-service-operator-fips< 2.21.1-r2
azure-vnet-cni< 1.9.2-r2 | All versions (No fix recorded)
azuredisk-csi-1.34< 1.34.7-r1
azuredisk-csi-1.35< 1.35.0-r1
azuredisk-csi-fips-1.33< 1.33.13-r1
azuredisk-csi-fips-1.34< 1.34.7-r1 | All versions (No fix recorded)
azuredisk-csi-fips-1.35< 1.35.0-r1
azuredisk-csi-fips-1.36< 1.36.0-r1
azurefile-csi-1.33< 1.33.10-r12
azurefile-csi-fips-1.33< 1.33.10-r14
azurefile-csi-fips-1.34< 1.34.10-r1
azurefile-csi-fips-1.35< 1.35.10-r1
backup-restore-operator-10.0< 10.0.10-r1
backup-restore-operator-8.1< 8.1.9-r2
backup-restore-operator-fips-10.0All versions (No fix recorded)
backup-restore-operator-fips-11.0< 11.0.3-r1
backup-restore-operator-fips-7.0< 7.0.11-r1
backup-restore-operator-fips-8.1< 8.1.9-r1
backup-restore-operator-fips-9.0< 9.0.8-r1
bank-vaults< 1.33.2-r5
bank-vaults-fips< 1.33.2-r6
bank-vaults-template< 1.33.2-r5
bank-vaults-template-fips< 1.33.2-r6
bank-vaults-vault-operator-fips< 1.24.1-r1
bento-fips< 1.22.0-r1
blob-csi-1.23< 1.23.11-r86
blob-csi-1.24< 1.24.11-r35
blob-csi-1.25< 1.25.10-r33
blob-csi-1.26< 1.26.17-r2
blob-csi-1.27< 1.27.11-r1
blob-csi-fips-1.23< 1.23.11-r90
blob-csi-fips-1.24< 1.24.11-r37
blob-csi-fips-1.25< 1.25.10-r31
blob-csi-fips-1.26< 1.26.17-r3
blob-csi-fips-1.27< 1.27.11-r1
blobfuse2-fips< 2.4.2-r24
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bomAll versions (No fix recorded)
boring-registry-fips< 0.19.0-r9
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildah-fips< 1.45.1-r3
buildctl-fips< 0.34.0-r1
buildkitd-fips< 0.34.0-r1
buildkite-agent-3< 3.138.0-r1
buildkite-agent-fips-3< 3.138.0-r1
buildkite-agent-fips-4< 4.3.0-r1
buildtools-buildifier-fipsAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 4065. Use Open JSON for the complete list.

References

9 links

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities