CVE-2026-94448

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: Go Project

Description

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94448

EUVD

EUVD-2026-95415

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library html/template 0
Go	standard	library html/template 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves JavaScript template literals with consecutive expressions where context tracking fails to reset properly. This causes incorrect handling of regular expression literals, potentially leading to improper escaping and security issues.

Detection Guidance

This vulnerability is specific to the Go programming language's html/template package and relates to improper context tracking in JavaScript template literals. Detection requires code review rather than network scanning.

Impact Analysis

It may allow attackers to inject malicious code through template literals, bypassing security controls like input validation or escaping mechanisms. This could lead to cross-site scripting (XSS) or other injection attacks.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to JavaScript template literal parsing in Go's html/template package. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Update to the latest version of Go where this issue has been fixed. Review JavaScript template literals in your code for consecutive expressions and ensure proper escaping of regular expression literals.

Hi! I’m here to help you understand CVE-2026-94448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70