An error in the Go standard library’s html/template package caused context tracking to fail across conditional branches and inside JavaScript template literals, resulting in improper escaping of user-supplied data. This allows an attacker to inject malicious scripts into page content, leading to client-side code execution. The vulnerability is identified as a Cross‑Site Scripting flaw (CWE-79).

Any Go application that uses the standard library’s html/template package to render JavaScript template literals is potentially affected. The advisory does not list specific Go versions, so users should verify whether their runtime precedes the release that introduced the fix and upgrade accordingly.

The vulnerability carries a CVSS 6.1 score, indicating a moderate impact. EPSS is reported at less than 1%, suggesting a low likelihood of widespread exploitation, and it is not listed in the CISA KEV catalog. Attackers would need to supply crafted template input that the application processes, exploiting the broken brace‑depth tracking to bypass escaping in a JS literal. Successful exploitation could lead to arbitrary script execution in users’ browsers, compromising confidentiality, integrity, and availability of the affected web service.