CVE-2026-97030 Go standard library CVE debrief

Who should care

Defenders responsible for Go applications, particularly those using the standard library's html/template package, should assess exposure and apply patches as needed. This includes reviewing and updating templates to ensure proper escaping of the 'yield' keyword and monitoring for any further updates or advisories from the Go project.

Why it matters

Defenders should prioritize verifying and applying patches for the Go standard library to prevent potential template injection attacks. The vulnerability affects versions 1.26.0 to 1.26.8 and 1.27.0-0 to 1.27.1, and patches are available in versions 1.26.9 and 1.27.2. Evidence is limited, and further verification is recommended.

• Potential for template injection attacks if not properly patched.
• Need for verification and application of patches for affected versions.
• Importance of reviewing and updating templates to ensure proper escaping of the 'yield' keyword.

Technical summary

The Go standard library's html/template package did not correctly escape the 'yield' keyword, potentially allowing for template injection attacks. This has been addressed in versions 1.26.9 and 1.27.2. The vulnerability affects versions 1.26.0 to 1.26.8 and 1.27.0-0 to 1.27.1. Defenders should prioritize verifying and applying patches for the Go standard library to prevent potential template injection attacks. The fix involves ensuring proper escaping of the 'yield' keyword in templates without introducing security risks.

Defensive priority

Defenders should prioritize verifying and applying patches for the Go standard library, particularly for versions 1.26.0 to 1.26.8 and 1.27.0-0 to 1.27.1.

Recommended defensive actions

• Verify and apply patches for the Go standard library, particularly for versions 1.26.0 to 1.26.8 and 1.27.0-0 to 1.27.1.
• Review and update templates to ensure proper escaping of the 'yield' keyword.
• Monitor for any further updates or advisories from the Go project.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide limited information about the vulnerability, with the primary details coming from the Go issue tracker and advisory. Evidence is limited, and further verification is recommended. The fix involves ensuring proper escaping of the 'yield' keyword in templates. Defenders should verify and apply patches for the Go standard library, particularly for versions 1.26.0 to 1.26.8 and 1.27.0-0 to 1.27.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.