CVE-2026-94448
published 2026-10-08CVE-2026-94448: When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
9.6th percentile
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | html_template | < 1.26.9 | 1.26.9 |
| go_standard_library | html_template | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
| satellite_el8 | yggdrasil-worker-forwarder | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
ghsa_unreviewed·2026-10-09
CVE-2026-94448 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
VulDB
Google html/template up to 1.26.8/1.27.1 Template Literal Expression cross site scripting
vuldb·2026-10-09
CVE-2026-94448 [LOW] Google html/template up to 1.26.8/1.27.1 Template Literal Expression cross site scripting
A vulnerability labeled as problematic has been found in Google html and template up to 1.26.8/1.27.1. This affects an unknown function of the component Template Literal Expression. The manipulation results in cross site scripting.
This vulnerability was named CVE-2026-94448. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
Red Hat
html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals
vendor_redhat·2026-10-08·CVSS 6.1
CVE-2026-94448 [MEDIUM] CWE-79 html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals
html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals
A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user's browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines-client (OpenShift Pipelines) - Fix deferred
P
No detection rules found.
No public exploits indexed.
2026-10-08
Published