The vulnerability is a flaw in Go’s html/template package that mishandles JavaScript regular expression syntax. By prematurely closing an unescaped slash, an attacker can inject arbitrary HTML or JavaScript content into a page rendered by the template. This flaw is classified as CWE‑79 and can compromise the integrity of client‑side content, allowing attackers to execute scripts in users’ browsers.

Any Go application that utilizes the standard library package html/template may be affected. The CVE description does not list specific Go releases, so the exact affected versions are unknown. The fix for issue GO‑2026‑6091 is referenced in the advisory links.

The EPSS score is under 1 %, indicating a very low probability of exploitation as of now. The CVSS score of 6.1 reflects moderate severity, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply crafted input that reaches the html/template processor in a JavaScript context. If successful, arbitrary script injection could lead to credential theft, defacement, or other client‑side attacks.