CVE-2026-97030: 
Go 脆弱性分析と緩和策

CVE-2026-97030 is a Cross-Site Scripting (XSS) vulnerability in the Go standard library's html/template package, caused by improper escaping of the yield keyword in templates. A trusted template author could craft a valid template where yield is not correctly escaped, potentially enabling injection of unintended content into rendered HTML pages. The vulnerability affects Go versions prior to 1.26.9 and versions 1.27.0-0 through 1.27.2. It was published on October 8, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The html/template package in Go failed to correctly escape the yield keyword when it appeared in template code, meaning a trusted template author could write a syntactically valid template that bypasses the package's output escaping logic. Exploitation requires user interaction (e.g., a victim visiting a page rendered from a maliciously crafted template) and is network-accessible with low attack complexity. The fix ensures that valid yield keyword uses are properly escaped while non-keyword uses of the string are left unescaped (GitHub Advisory, Go Vuln DB).

Successful exploitation could allow an attacker with template authoring privileges to inject arbitrary HTML or JavaScript into pages rendered for other users, resulting in low confidentiality and integrity impacts with no availability impact. The vulnerability's changed scope means the impact extends beyond the vulnerable component itself to the browsers of end users viewing the affected pages. Potential consequences include session hijacking, credential theft, or delivery of malicious payloads to victims (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.181%, placing it in the 7th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have trusted template authoring access, which limits the attack surface considerably.

1. Gain template authoring access: Obtain trusted access to write or modify Go html/template templates in the target application (e.g., as a developer, CMS contributor, or through a separate vulnerability allowing template injection).
2. Craft a malicious template: Write a valid Go template that includes the yield keyword in a context where, in unpatched versions, it would not be correctly escaped — for example, embedding JavaScript or HTML within a template block that uses yield.
3. Deploy the template: Ensure the malicious template is rendered by the application for end users, such as by modifying a shared template file or a database-backed template.
4. Trigger victim interaction: Lure a victim user to visit the page rendered from the malicious template (user interaction is required per the CVSS vector).
5. Achieve XSS: The unescaped yield content is rendered in the victim's browser, executing injected JavaScript — enabling session theft, credential harvesting, or further attacks (GitHub Advisory, Go Vuln DB).

Upgrade Go to version 1.26.9 or later (for the 1.26.x branch), or to 1.27.2 or later (for the 1.27.x branch). No configuration-based workaround is available; patching is the only remediation. Organizations should also review existing templates that use the yield keyword to confirm they do not rely on the previous (incorrect) escaping behavior, as the fix changes how yield is handled (GitHub Advisory, Go Vuln DB). SUSE has also released security updates addressing this issue (SUSE Advisory).

The vulnerability was announced via the golang-announce mailing list and tracked in the Go issue tracker. SUSE released security advisories (SUSE-SU-2026:4625-1 and SUSE-SU-2026:4629-1) addressing the issue in their Go packages. The Hugo static site generator also released v0.168.0 incorporating the fix. Community reaction has been low-key given the moderate severity and limited exploitation prerequisites (golang-announce, SUSE Advisory, Hugo Release).