Vulnerability Intelligence Report

Fix Javascript regexp context tracking in html/template

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

No Active Exploit Signals

CVSS Base Score

6.1

MEDIUM

Exploitability:2.9

Impact Score:2.8

EPSS Probability:0.20%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

Affected Products & Versions

Vendor	Product	Affected Versions
No affected products specified.

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

0.199%

GitHub Advisory

GHSA-c974-w86c-vpfw ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	Go Project · Vendor · USA
Reserved	2026-06-23T15:10:49
Published	2026-08-13T21:58:53
Last Updated	2026-08-14T15:32:29

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2026-56858

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2026-56858

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE