{"id":"CVE-2026-94448","kind":"vulnerability","aliases":["CVE-2026-94448","GO-2026-6599"],"related":[],"title":"Reset context tracking on consecutive template expressions in html/template","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.","summary":"Go's standard library html/template package failed to reset its JavaScript context tracking between consecutive template expressions inside a JavaScript template literal. The sources say this can cause regular expression literals to be escaped incorrectly, which can let untrusted input reach the page in a context where it is not safely escaped.","severity":"medium","cvss":6.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","html/template","package","server-rendered-html","web-servers"],"not_affected_if":["no-js-template-literals-with-user-data","not-using-html-template","pre-1.27.0-toolchain"],"how_to_check":"Run go version in the build environment and check whether the Go toolchain is in the affected range 1.27.0 through before 1.27.2.\nSearch go.mod files for the go directive and check which toolchain CI uses.","fix":"Upgrade the Go toolchain to 1.27.2 or 1.26.9, then rebuild and redeploy services that render html/template output.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:57:55+00:00","updated_at":"2026-10-23T19:57:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:57:55Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.27.2 or 1.26.9, then rebuild and redeploy services that render html/template output.\nunknown","summary":"Go's standard library html/template package failed to reset its JavaScript context tracking between consecutive template expressions inside a JavaScript template literal. The sources say this can cause regular expression literals to be escaped incorrectly, which can let untrusted input reach the page in a context where it is not safely escaped.","category":"package","who_cares":["go","html/template","web-servers","server-rendered-html"],"confidence":0.7,"analyst_note":"Confirm the exact escaping impact and whether 1.26.x fixed line is the only backport, via https://pkg.go.dev/vuln/GO-2026-6599 and https://nvd.nist.gov/vuln/detail/CVE-2026-94448.","how_to_check":"Run go version in the build environment and check whether the Go toolchain is in the affected range 1.27.0 through before 1.27.2.\nSearch go.mod files for the go directive and check which toolchain CI uses.\nunknown","needs_analyst":true,"not_affected_if":["not-using-html-template","no-js-template-literals-with-user-data","pre-1.27.0-toolchain"],"severity_if_unknown":"medium"},"cost_usd":0.000435,"input_tokens":2108,"output_tokens":448,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A,17A '-6599':15A '-94448':12A,18A 'accur':123C 'caus':57B 'consecut':5A,44B,88C 'contain':87C 'context':2A,41B,75B,91C,114C 'correct':112C 'cve':10A,16A 'ensur':105C 'enter':99C 'entri':111C 'escap':63B,81B,126C 'express':7A,46B,59B,89C,102C,110C,120C 'fail':36B 'go':13A,20B,30B 'html':26B 'html/template':9A,21B,34B 'incorrect':64B 'input':69B 'insid':47B 'javascript':40B,49B,84C 'let':67B 'librari':33B 'liter':51B,60B,86C,109C,121C 'new':101C 'packag':22B,35B 'page':72B 'proper':96C 'reach':70B 'recogn':124C 'regular':58B,119C 'render':25B 'reset':1A,38B,97C,113C 'safe':80B 'say':54B 'server':24B,29B 'server-rendered-html':23B 'sourc':53B 'standard':32B 'state':93C 'stdlib':19A 'subsequ':118C 'templat':6A,45B,50B,85C,108C 'template-liter':107C 'track':3A,42B,92C 'untrust':68B 'upon':98C 'variabl':115C 'web':28B 'web-serv':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6599","url":"https://pkg.go.dev/vuln/GO-2026-6599","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94448","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94448","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","severity":null,"published_at":"2026-10-08T23:17:05+00:00","modified_at":"2026-10-15T16:18:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}