Repository navigation
html/template: XSS via missing ES2015+ keywords in regexpPrecederKeywords #81823
Description
html/template: recognize yield as regexp preceder keyword
A trusted template author may have previously
written a valid template wherein the use of
the yield keyword would not be correctly
escaped.
We now ensure that valid keyword uses are
escaped and non-keyword uses are not escaped.
This is CVE-2026-97030 and Go issue https://go.dev/issue/81823.
This was a PUBLIC track issue originally tracked in http://b/545173274.
Activity
gabyhelp commentedon Sep 28, 2026
Related Issues
Related Code Changes
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
[-]html/template: XSS via missing ES2015+ keywords in regexpPrecederKeywords (await, yield, default)[/-][+]html/template: XSS via missing ES2015+ keywords in regexpPrecederKeywords[/+]gopherbot commentedon Sep 28, 2026
Change https://go.dev/cl/840925 mentions this issue:
html/template: recognizeyieldas regexp preceder keywordthatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81909 (for 1.26), #81910 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
html/template: recognize `yield` as regexp preceder keyword
gopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843645 mentions this issue:
html/template: recognizeyieldas regexp preceder keywordgopherbot commentedon Oct 2, 2026
Change https://go.dev/cl/843625 mentions this issue:
html/template: recognizeyieldas regexp preceder keyword[release-branch.go1.27] html/template: recognize `yield` as regexp pr…
[release-branch.go1.26] html/template: recognize `yield` as regexp pr…