If a trusted template author were to write a <script>
tag containing an empty type attribute or a type
attribute with an ASCII whitespace, the execution of
the template would incorrectly escape any data passed
into the <script> block.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

This is CVE-2026-39826 and Go issue https://go.dev/issue/78981.

This was a PUBLIC track issue, tracked in http://b/496225621.