BDSA-2026-36001
BDSA
Medium
False Positivehtml/template: Incorrect Escaping of Regular Expressions in JavaScript Literals
This advisory does not affect KrakenD
KrakenD is an API gateway and does not use
html/template to render HTML in any of
its responses, so the escaping logic is never used to produce output.No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
Go standard library (html/template)
Disclosed
Nov 4, 2026
Description
Go’s
html/template escapes regular expressions inside JavaScript literals
incorrectly, which can lead to cross-site scripting in pages rendered from affected
templates. This does not affect KrakenD.