CVE-2023-39318 Improper handling of HTML-like comments in script contexts in html/template

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in html/template Improper Handling Vulnerabilities Five vulnerabilities have been published related to improper handling in the html/template package, affecting various aspects such as HTML comments, special tags, empty attributes, JavaScript whitespace, and CSS values. These vulnerabilities could potentially allow for exploitation in applications utilizing this package. The CVEs were published on February 18, 2026, with earlier known publication dates in 2023. 6 sources 44