Search results

html/template: provide JS variable population helper, disable arbitrary template actions inside of <script> contexts

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Security

Thinking

Status: Open.

#77031 In golang/go;

· rolandshoemaker opened on Dec 29, 2025

·  

Backlog

cmd/go: defensively unset dangerous VCS configuration options

GoCommandcmd/gocmd/go

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Security

Status: Open.

#74520 In golang/go;

· rolandshoemaker opened on Jul 8, 2025

cmd/go: toolchain directive can point to file relative to go.mod with ADS on windows

GoCommandcmd/gocmd/go

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

OS-Windows

Security

Status: Open.

#71470 In golang/go;

· rolandshoemaker opened on Jan 28, 2025

os/exec: LookPath considers paths containing ":" to be absolute on windows

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

OS-Windows

Security

Status: Open.

#71469 In golang/go;

· rolandshoemaker opened on Jan 28, 2025

html/template: template Parse/Execute escaping race

NeedsDecisionFeedback is required from experts, contributors, and/or the community before a change can be made.Feedback is required from experts, contributors, and/or the community before a change can be made.

Security

Status: Open.

#69404 In golang/go;

· rolandshoemaker opened on Sep 11, 2024

·  

Backlog

net/smtp: most fields are not validated or sanitized

NeedsDecisionFeedback is required from experts, contributors, and/or the community before a change can be made.Feedback is required from experts, contributors, and/or the community before a change can be made.

Security

Status: Open.

#66146 In golang/go;

· rolandshoemaker opened on Mar 6, 2024

·  

Backlog

crypto: post-quantum support roadmap

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Security

umbrella

Status: Open.

#64537 In golang/go;

· rolandshoemaker opened on Dec 4, 2023

·  

Backlog

runtime, syscall, x/sys/windows: unexpected DLL loading behavior

compiler/runtimeIssues related to the Go compiler and/or runtime.Issues related to the Go compiler and/or runtime.

NeedsFixThe path to resolution is known, but the work has not been done.The path to resolution is known, but the work has not been done.

OS-Windows

Security

Status: Open.

#64411 In golang/go;

· rolandshoemaker opened on Nov 27, 2023

·  

Backlog

doc/godebug: allow carve out for GODEBUGs introduced in security releases

DocumentationIssues describing a change to documentation.Issues describing a change to documentation.

FixPendingIssues that have a fix which has not yet been reviewed or submitted.Issues that have a fix which has not yet been reviewed or submitted.

Proposal

Proposal-Accepted

Security

Status: Open.

#63741 In golang/go;

· rolandshoemaker opened on Oct 25, 2023

·  

Backlog

html/template: treatment of CDATA sections in foreign content diverges from browsers

NeedsFixThe path to resolution is known, but the work has not been done.The path to resolution is known, but the work has not been done.

Security

Status: Open.

#62617 In golang/go;

· rolandshoemaker opened on Sep 13, 2023

·  

Go1.26