High [CVE-2026-56858] Go html/template: Cross-Site Scripting via pathological input
This high-severity Red Hat Linux advisory covers CVE-2026-56858 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. A flaw was found in the `html/template` component of Go (golang).
This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions. This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package.
Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
Weakness: CWE-79.
Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 53 more.
Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; external secrets operator for Red Hat OpenShift 1.2; Logging Subsystem for Red Hat OpenShift 6.6; and 49 more.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- golang-0:1.26.7-1.el10_2
- grafana-0:10.2.6-28.el10_2.5
- grafana-pcp-0:5.3.0-8.el10_2.1
- buildah-2:1.43.1-5.el10_2
- buildah-2:1.43.1-6.el10_2
- skopeo-2:1.22.2-5.el10_2
- opentelemetry-collector-0:0.152.1-2.el10_2
- image-builder-0:52.1-1.el10_2.2
- osbuild-composer-0:165.1-3.el10_2.2
- golang-0:1.26.7-1.el10_0
- ignition-0:2.21.0-3.el10_0.4
- delve-0:1.26.1-2.el10_0
- osbuild-composer-0:134.1-12.el10_0
- grafana-pcp-0:5.3.0-1.el10_0.1
- go-toolset:rhel8-8100020260824145918.a3795dee
- grafana-0:9.2.10-33.el8_10
- grafana-pcp-0:5.1.1-18.el8_10
- container-tools:rhel8-8100020260901110702.afee755d
- osbuild-composer-0:101.5-2.el8_10
- golang-0:1.26.7-1.el9_8
- grafana-0:10.2.6-23.el9_8.3
- rhc-1:0.2.7-11.el9_8
- grafana-pcp-0:5.1.1-17.el9_8.1
- opentelemetry-collector-0:0.152.1-2.el9_8
- osbuild-composer-0:165.1-4.el9_8.1
- image-builder-0:52.1-1.el9_8.2
- golang-0:1.26.7-1.el9_2
- osbuild-composer-0:76.1-9.el9_2
- ignition-0:2.15.0-2.el9_2.1
- golang-0:1.26.7-1.el9_4
- osbuild-composer-0:101.3-4.el9_4.6
- ignition-0:2.17.0-2.el9_4.2
- golang-0:1.26.7-1.el9_6
- osbuild-composer-0:132.2-12.el9_6
- ignition-0:2.21.0-7.el9_6.1
- custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9:1788361753
- custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9:1788361758
- custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9:1788290523
- custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9:1788290620
- custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9:1788290333
- RHSA-2026:60306
- RHSA-2026:63022
- RHSA-2026:63119
- RHSA-2026:63332
- RHSA-2026:64777
- RHSA-2026:64818
- RHSA-2026:65116
- RHSA-2026:65534
- RHSA-2026:65895
- RHSA-2026:61882
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation
Upgrade to a fixed release: golang-0:1.26.7-1.el10_2, grafana-0:10.2.6-28.el10_2.5, grafana-pcp-0:5.3.0-8.el10_2.1, buildah-2:1.43.1-5.el10_2, buildah-2:1.43.1-6.el10_2, skopeo-2:1.22.2-5.el10_2. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.