CVE-2026-97030

MediumCVSS 6.1

Published: 08/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Previously, a trusted template author could write a valid template where the use of the 'yield' keyword was not correctly escaped. Now valid keyword uses are escaped and non-keyword uses are not escaped.

Risk Assessment

Improper escaping could lead to template generation errors or potential security vulnerabilities if input was mishandled.

Recommendation

Upgrade to the patched version. Review templates for 'yield' usage and ensure they conform to the new behavior.

Other vulnerabilities in Template engine

CVE-2026-39826Medium
If a trusted template author writes a <script> tag with an empty 'type' attribute or a 'type' attribute containing ASCII whitespace, template execution incorrectly escapes data passed into the <script> block. This may lead to unintended JavaScript execution.

Original NVD description (English source)

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS