CVE-2026-56858: Fix Javascript regexp context tracking in html/template
Fix Javascript regexp context tracking in html/template
Other sources
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.8-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56858?
The severity of CVE-2026-56858 is rated as 56, indicating a moderate risk level.
What type of vulnerability is identified in CVE-2026-56858?
CVE-2026-56858 is classified as an XSS (Cross-Site Scripting) vulnerability.
How do I fix CVE-2026-56858?
To fix CVE-2026-56858, ensure that input data is properly escaped before being processed by the HTML/template package.
What can be exploited in CVE-2026-56858?
CVE-2026-56858 can be exploited through pathological inputs that lead to injection of arbitrary content via XSS.
When was CVE-2026-56858 published?
CVE-2026-56858 was published on August 13, 2026.