Go html/template CVE-2026-56858

Go's html/template package extends the text/template package with context-aware escaping to safely embed untrusted data into HTML documents. The engine maintains an internal parse state machine that tracks the current rendering context - HTML body, attribute, JavaScript string, JavaScript regexp, CSS, and others - to apply the correct escaping function before output. The vulnerability is in the JavaScript regexp context transition logic: certain pathological inputs cause the state machine to interpret an unescaped forward-slash character as a regexp terminator prematurely, incorrectly transitioning the parser out of the regexp context. Any template data rendered after this point is emitted under the wrong escaping rules, allowing injection of arbitrary JavaScript. This is consistent with CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a context-tracking failure in a component that exists precisely to prevent such issues. No CPE strings were provided in the input data; affected packages are the html/template standard library components shipped with Go prior to 1.26.6 and 1.25.13.