CVE-2026-94448

Received Received - Intake

Template Literal Context Tracking Flaw in Go

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-94448

EUVD

EUVD-2026-95415

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library html/template 0
Go	standard	library html/template 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves JavaScript template literals with consecutive expressions where context tracking fails to reset properly. This causes incorrect handling of regular expression literals, potentially leading to improper escaping and security issues.

Impact Analysis

It may allow attackers to inject malicious code through template literals, bypassing security controls like input validation or escaping mechanisms. This could lead to cross-site scripting (XSS) or other injection attacks.

Mitigation Strategies

Update to the latest version of Go where this issue has been fixed. Review JavaScript template literals in your code for consecutive expressions and ensure proper escaping of regular expression literals.

Hi! I’m here to help you understand CVE-2026-94448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70