The Go standard library html/template package is intended to escape data injected into templates so that HTML, CSS, and JavaScript contexts remain safe. When a trusted template author writes a <script> tag with an empty or whitespace‑only "type" attribute, the rendering logic incorrectly treats the content as plain text and skips the escape step. Any data that is substituted into the script block is therefore inserted verbatim, allowing an attacker who can supply a susceptible template to inject arbitrary JavaScript and execute it in the visitor’s browser.

This vulnerability affects the Go programming language’s core library component html/template. No specific version numbers are supplied, so all releases prior to the release that contains the rectification are potentially vulnerable. The issue is only exploitable when the attacker has the ability to provide or modify trusted template files that include the problematic <script> tags.

Exploitation requires the attacker to supply a template that contains the vulnerable <script> tag; it is not triggered solely by untrusted user input. If such a template is rendered, cross‑site scripting can be achieved, potentially enabling session hijacking, phishing, or data theft. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The CVSS score of 6.1 indicates a moderate severity.