Go html/template CVE-2026-97030

Exploitation requires that the affected Go application's own trusted html/template source contains the JavaScript yield keyword immediately preceding a regular-expression literal, and that attacker-influenced data is interpolated into that mis-escaped region - this specific template construct is the hard prerequisite and is not present in typical templates. Limiting factors: the template author must have written this pattern (a self-inflicted but non-default condition), the application must server-render HTML via html/template rather than serve JSON APIs, a victim must load the rendered page (user interaction), and only applications upgrading to or already on the unpatched Go toolchain versions are affected. There is no remote unauthenticated path against a default/empty configuration; the vulnerability is latent unless the yield-plus-regexp template construct exists.

This analysis is scoped to CVE-2026-97030 only (html/template: recognize |yield| as regexp preceder keyword), one of several fixes bundled in the Go 1.27.2 / 1.26.9 release announcement. No CVSS vector, CWE, EPSS score, KEV listing, or POC is provided in the input, so quantitative exploitation signals are entirely absent and cannot be compared. Qualitatively, this is a template auto-escaping context-tracking defect: when a trusted template author uses the JavaScript yield keyword, html/template previously failed to recognize it as a regexp-preceder keyword, causing a following regular-expression literal to be mis-contextualized and improperly escaped. The real-world risk is conditional and modest: exploitation is not a direct remote-code or crash path but a potential cross-site scripting (XSS) exposure that only materializes if (a) an application's own trusted template happens to use the yield keyword in the specific JS context and (b) attacker-influenced data flows into the mis-escaped region. This is therefore a low-to-moderate real-world priority despite being in a widely used standard library - it is not a high-CVSS-but-low-risk issue so much as an unscored, narrow-trigger escaping bug. It stands in sharp contrast to sibling CVEs in the same release (e.g. the HTTP/2 crash CVE-2026-97032, the Trailer memory-exhaustion CVE-2026-78659, or the CONNECT desync CVE-2026-...) which are remotely triggerable by a malicious client against default servers; this particular issue requires a specific template construct to exist in the victim application. No conflicting signals exist because almost no risk metadata was supplied - the primary caveat is simply the near-total absence of scoring data.

A Go web application renders a server-side html/template that embeds the yield keyword inside a JavaScript context followed by a regular-expression literal that incorporates request-derived data. Because html/template did not recognize yield as a regexp-preceder keyword, the following literal is mis-escaped, allowing an attacker who controls that data to break out of the intended JS context and inject script that executes in a victim's browser. No public exploit identified at time of analysis; exploitation is passive, requiring a victim to load the affected page.