---
id: "CVE-2026-94448"
kind: "vulnerability"
aliases: ["CVE-2026-94448", "GO-2026-6599"]
title: "Reset context tracking on consecutive template expressions in html/template"
severity: "medium"
cvss: 6.1
epss: 0.00202
exploited: false
status: "open"
category: "package"
products: [{"name": "stdlib", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "html/template", "package", "server-rendered-html", "web-servers"]
not_affected_if: ["no-js-template-literals-with-user-data", "not-using-html-template", "pre-1.27.0-toolchain"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:57:55+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6599", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94448", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94448", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Reset context tracking on consecutive template expressions in html/template

Go's standard library html/template package failed to reset its JavaScript context tracking between consecutive template expressions inside a JavaScript template literal. The sources say this can cause regular expression literals to be escaped incorrectly, which can let untrusted input reach the page in a context where it is not safely escaped.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run go version in the build environment and check whether the Go toolchain is in the affected range 1.27.0 through before 1.27.2.
Search go.mod files for the go directive and check which toolchain CI uses.

## Fix

Upgrade the Go toolchain to 1.27.2 or 1.26.9, then rebuild and redeploy services that render html/template output.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6599
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94448
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94448

## From the sources

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.

We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_