Repository navigation
html/template: JS template literal context incorrectly tracked #78331
Description
Context was not properly tracked across template branches for JS template
literals, leading to possibly incorrect escaping of content when branches were
used.
Additionally template actions within JS template literals did not properly track
the brace depth, leading to incorrect escaping being applied.
These issues could cause actions within JS template literals to be incorrectly
or improperly escaped, leading to XSS vulnerabilities.
This only affects templates that use template actions within JS template literals.
This is CVE-2026-32289 and Go issue https://go.dev/issue/78331.
This is a PRIVATE issue for CVE-2026-32289, tracked in http://b/491530416 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3882.
/cc @golang/security and @golang/release
Activity
neild commentedon Mar 27, 2026
@gopherbot please open backport issues for this security fix
gopherbot commentedon Mar 27, 2026
Backport issue(s) opened: #78416 (for 1.25), #78417 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763543 mentions this issue:
[release-branch.go1.26] html/template: properly track JS template literal brace depth across contextsgopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763551 mentions this issue:
[release-branch.go1.25] html/template: properly track JS template literal brace depth across contexts[release-branch.go1.25] html/template: properly track JS template lit…
[release-branch.go1.26] html/template: properly track JS template lit…
[-]security: fix CVE-2026-32289[/-][+]html/template: JS template literal context incorrectly tracked[/+]gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763762 mentions this issue:
html/template: properly track JS template literal brace depth across contextshtml/template: properly track JS template literal brace depth across …