CLEANSTART-2026-TD29109: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actio...

Q: What conditions are required for exploitation?

An attacker needs the ability to cause a MarshalJSON method to return an error containing attacker-controlled data. That error must then be processed in a way that breaks html/template contextual auto-escaping, enabling later template actions to inject unexpected content.

Q: What is the likely security impact?

The issue can undermine contextual escaping in Go html/template and allow unexpected content to be injected through subsequent template actions. The provided severity vector indicates network reachability, low attack complexity, low privileges required, no user interaction, and low confidentiality and integrity impact.

Q: How can I determine whether my deployment is affected?

Review whether cleanstart/argo-workflows processes MarshalJSON errors containing user-controlled values and subsequently renders templates using html/template. The provided data does not identify affected or fixed package versions.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-24785

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs the ability to cause a MarshalJSON method to return an error containing attacker-controlled data. That error must then be processed in a way that breaks html/template contextual auto-escaping, enabling later template actions to inject unexpected content.

What is the likely security impact?

The issue can undermine contextual escaping in Go html/template and allow unexpected content to be injected through subsequent template actions. The provided severity vector indicates network reachability, low attack complexity, low privileges required, no user interaction, and low confidentiality and integrity impact.

How can I determine whether my deployment is affected?

Review whether cleanstart/argo-workflows processes MarshalJSON errors containing user-controlled values and subsequently renders templates using html/template. The provided data does not identify affected or fixed package versions.

CLEANSTART-2026-TD29109: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actio...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the likely security impact?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the likely security impact?

How can I determine whether my deployment is affected?