Go html/template CVE-2026-39826

The Go html/template package provides contextual HTML escaping to prevent injection vulnerabilities. The vulnerability resides in the template parser's handling of script tag type attributes: when the 'type' attribute is empty or contains only ASCII whitespace characters (space, tab, newline, carriage return, form feed), the parser fails to recognize this as a script context and applies incorrect escaping rules. This allows data interpolation within the script block to bypass the intended HTML entity encoding that would normally occur. The root cause appears to be improper validation of the 'type' attribute value during template compilation, affecting the context-sensitive escaping logic. CPE cpe:2.3:a:go_standard_library:html/template:*:*:*:*:*:*:*:* identifies the Go standard library's html/template as the affected component.