CVE-2026-93591: Go Sql Concat Unescaped Node Text Injectioncve-2026-93591-go-sql-concat-unescaped-node-text-injection
Text extracted from a parsed document node ($NODE.Text()) reaches a SQL string literal built by concatenation without escaping single quotes. A single quote in attacker-controllable content closes the SQL string literal and allows arbitrary SQL injection into the executed statement. Escape the value for the SQL string literal context before interpolation, e.
