If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade go | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golist-debuginfoUpgrade runc-debuginfoUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade oci-add-hooksUpgrade golangUpgrade amazon-ecr-credential-helper-debuginfoUpgrade golistUpgrade dockerUpgrade golang-srcUpgrade golang-miscUpgrade nerdctlUpgrade containerdUpgrade soci-snapshotterUpgrade golang-binUpgrade containerd-stressUpgrade oci-add-hooks-debuginfoUpgrade golang-sharedUpgrade amazon-cloudwatch-agentUpgrade amazon-ecr-credential-helperUpgrade golang-testsUpgrade containerd-debuginfoUpgrade golang-docsUpgrade ecs-initUpgrade nerdctl-debuginfoUpgrade runc | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade golist-debuginfoUpgrade amazon-ecr-credential-helperUpgrade containerdUpgrade containerd-debugsourceUpgrade golang-sharedUpgrade soci-snapshotterUpgrade golang-miscUpgrade docker-debuginfoUpgrade docker-debugsourceUpgrade oci-add-hooks-debuginfoUpgrade containerd-stress-debuginfoUpgrade golangUpgrade credentials-fetcherUpgrade oci-add-hooksUpgrade runc-debuginfoUpgrade golist-debugsourceUpgrade runc-debugsourceUpgrade golistUpgrade golang-srcUpgrade golang-binUpgrade golang-docsUpgrade runfinch-finchUpgrade oci-add-hooks-debugsourceUpgrade golang-testsUpgrade runcUpgrade containerd-stressUpgrade nerdctlUpgrade dockerUpgrade ecs-initUpgrade containerd-debuginfo | May 28, 2026 | May 7, 2026 |
| Freebsd | — | Upgrade gohugo | Jun 15, 2026 | May 29, 2026 |
| Oracle_linux | — | Upgrade golang-srcUpgrade golang-testsUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-docsUpgrade go-toolsetUpgrade delveUpgrade golang-bin | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade golangUpgrade golang-binUpgrade golang-testsUpgrade golang-miscUpgrade golang-raceUpgrade delve-debugsourceNo solution existsUpgrade golang-srcUpgrade delve-debuginfoUpgrade golang-docsUpgrade go-toolsetUpgrade delve | Jul 17, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade golangUpgrade delve-debuginfoUpgrade golang-raceUpgrade delve-debugsourceUpgrade delveUpgrade go-toolsetUpgrade golang-bin | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub