CVE-2026-39826

Escaper bypass leads to XSS in html/template

Medium · published May 7, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Published
2026-05-07T19:41Z
EPSS history
Timeline
  • 07 MAY 19:41Z
    Escaper bypass leads to XSS in html/template
    cvelistv5