CVE-2026-56858

6.1 mediumEPSS 0.3%

Medium (6.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in stdlib 1.25.13, 1.26.6, 1.27.0-rc.3.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-08-13
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2026-6091	Go	stdlib	<1.25.13 >=1.26.0-0 <1.26.6 >=1.27.0-0 <1.27.0-rc.3	1.25.13, 1.26.6, 1.27.0-rc.3

References

https://go.dev/cl/807100
https://go.dev/issue/80435
https://groups.google.com/g/golang-announce/c/94pEornpRlI
https://pkg.go.dev/vuln/GO-2026-6091

Check your stack JSON