Live › vulnerability › CVE-2026-94448
Go to dashboardGo's standard library html/template package failed to reset its JavaScript context tracking between consecutive template expressions inside a JavaScript template literal. The sources say this can cause regular expression literals to be escaped incorrectly, which can let untrusted input reach the page in a context where it is not safely escaped.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
1.27.0 through before 1.27.2Upgrade the Go toolchain to 1.27.2 or 1.26.9, then rebuild and redeploy services that render html/template output.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
This page as .md · .json · in your agent: get_signal("CVE-2026-94448")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.