CVE-2026-39826

MediumCVSS 6.1

Published: 07/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

If a trusted template author writes a <script> tag with an empty 'type' attribute or a 'type' attribute containing ASCII whitespace, template execution incorrectly escapes data passed into the <script> block. This may lead to unintended JavaScript execution.

Risk Assessment

An attacker able to supply a template or its data could exploit this to inject and execute malicious script in the application context. This may lead to data theft or user session compromise.

Recommendation

Update the software to a version containing the fix for data escaping in <script> blocks. Avoid using untrusted templates.

Other vulnerabilities in Template engine

CVE-2026-97030Medium
Previously, a trusted template author could write a valid template where the use of the 'yield' keyword was not correctly escaped. Now valid keyword uses are escaped and non-keyword uses are not escaped.

Original NVD description (English source)

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS