6.1
Moyenne
CVE-2026-32289 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect…
Description
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| html/template 1.26 | 1.26.0-0 → < 1.26.2 | 1.26.2 |
| html/template 1.25 | premières → < 1.25.9 | 1.25.9 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de html/template
Les 14 CVE de html/template →
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would…
6.1
Moyenne
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset…
6.1
Moyenne
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject…
6.1
Moyenne
CVE-2026-39826
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an…
6.1
Moyenne