| CVE-2026-94448 |
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset…
|
6.1
Medium
|
Oct 8, 2026 |
| CVE-2026-97030 |
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would…
|
6.1
Medium
|
Oct 8, 2026 |
| CVE-2026-56858 |
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject…
|
6.1
Medium
|
Aug 13, 2026 |
| CVE-2026-39826 |
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an…
|
6.1
Medium
|
May 7, 2026 |
| CVE-2026-39823 |
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's …
|
6.1
Medium
|
May 7, 2026 |
| CVE-2026-32289 |
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect…
|
6.1
Medium
|
Apr 8, 2026 |
| CVE-2026-27142 |
Actions which insert URLs into the content attribute of HTML meta tags are not escaped
|
6.1
Medium
|
Mar 6, 2026 |
| CVE-2024-24785 |
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual…
|
5.4
Medium
|
Mar 5, 2024 |
| CVE-2023-39319 |
The html/template package does not apply the proper rules for handling occurrences of…
|
Not rated
|
Sep 8, 2023 |
| CVE-2023-39318 |
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in …
|
Not rated
|
Sep 8, 2023 |
| CVE-2023-24539 |
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts
|
7.3
High
|
May 11, 2023 |
| CVE-2023-24540 |
Not all valid JavaScript whitespace characters are considered to be whitespace
|
9.8
Critical
|
May 11, 2023 |
| CVE-2023-29400 |
Templates containing actions in unquoted HTML attributes (e.g
|
7.3
High
|
May 11, 2023 |
| CVE-2023-24538 |
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected
|
9.8
Critical
|
Apr 6, 2023 |