Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-94448

Reset context tracking on consecutive template expressions in html/template

Description

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library html/template

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

References