Описание
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.27 | fixed | 1.27.2-1 | package | |
| golang-1.26 | fixed | 1.26.9-1 | package | |
| golang-1.25 | removed | package | ||
| golang-1.24 | removed | package | ||
| golang-1.24 | no-dsa | trixie | package | |
| golang-1.19 | removed | package |
Примечания
https://www.openwall.com/lists/oss-security/2026/10/08/9
https://github.com/golang/go/issues/81823
Fixed by: https://github.com/golang/go/commit/6e2cfab0a1c1683c52f9e09270627b0c4e6446e3 (go1.27.2)
Fixed by: https://github.com/golang/go/commit/5d84f6f08caf63b5f1300930368756bd34955f4a (go1.26.9)
EPSS
Связанные уязвимости
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
EPSS