CVE-2026-56858
CVE
Medium
False Positivehtml/template: XSS via Early Unescaped Slash Closure
This advisory does not affect KrakenD
KrakenD is an API gateway that proxies and transforms JSON/XML/gRPC traffic; it does
not use
html/template to render HTML output anywhere in its request path, so the
vulnerable escaping logic is never invoked.Addressed through routine dependency maintenance in CE 2.13.9 and EE 2.13.7.
Component
Go standard library (html/template)
Disclosed
Aug 14, 2026
Description
Go’s
html/template package could be tricked by pathological input into closing an
unescaped / earlier than intended inside a JavaScript regexp literal context,
letting attacker-controlled data inject arbitrary script content. This could lead to
cross-site scripting in applications that render untrusted data through
html/template. The fix corrects the escaper’s tracking of JavaScript regexp
context.
This does not affect KrakenD, which never renders HTML templates.