Go html/template XSS Vulnerability Advisory (GO-2026-6599/CVE-2026-94448)

Vulnerability Overview Vulnerability ID: GO-2026-6599 Affected Package: html/template Release Date: October 8, 2026 Description: When JavaScript template literals contain consecutive expressions, the context tracking state is not correctly reset when entering a new expression. This fix ensures that template literal expression entries correctly reset context variables, allowing all subsequent regular expression literals to be accurately identified and escaped. Scope Affected Path: html/template Go Versions: - Before go1.26.9 - Before go1.27.0 - Before go1.27.2 Symbols: - Template.Execute - Template.ExecuteTemplate Remediation Fixed Versions: - go1.26.9 and later - go1.27.0 and later - go1.27.2 and later Additional Information Alias: CVE-2026-94448 Reference Links: - https://go.dev/cl/839866 - https://go.dev/issue/81821 - https://groups.google.com/g/golang-announce/c/U2YfuyDzjmi - https://vuln.go.dev/ID/GO-2026-6599.json Feedback If you notice any omissions or inaccuracies, please edit this report. Footer Information Copyright: Google Terms of Service: Terms of Service Privacy Policy: Privacy Policy Report an Issue: Report an Issue Theme Toggle: Theme Toggle Shortcuts Modal: Shortcuts Modal Navigation Bar Why Go: Use Cases, Case Studies Get Started: Playground, Tour, Stack Overflow, Help Packages: Standard Library, Sub-repositories, About Go Packages, pkg.go.dev API About: Download, Blog, Issue Tracker, Release Notes, Brand Guidelines, Code of Conduct Connect: Twitter, GitHub, Slack, /r/golang, Meetup, Golang Weekly Search Box Search packages or symbols: Search packages or symbols Community Community: Community Docs Docs: Docs Learn Learn: Learn Packages Packages: Packages Why Go Why Go: Why Go Vulnerability Database Vulnerability Database: Vulnerability Database All Reports All Reports: All Reports GO-2026-6599 GO-2026-6599: GO-2026-6599 Standard Library Standard Library: Standard Library Template.Execute Template.Execute: Template.Execute Template.ExecuteTemplate Template.ExecuteTemplate: Template.ExecuteTemplate CVE-2026-94448 CVE-2026-94448: CVE-2026-94448 Reference Links Reference Links: Reference Links Feedback Feedback: Feedback Footer Footer: Footer Navigation Bar Navigation Bar: Navigation Bar Search Box Search Box: Search Box Community Community: Community Docs Docs: Docs Learn Learn: Learn Packages Packages: Packages Why Go Why Go: Why Go Vulnerability Database Vulnerability Database: Vulnerability Database All Reports All Reports: All Reports GO-2026-6599 GO-2026-6599: GO-2026-6599 Standard Library Standard Library: Standard Library Template.Execute Template.Execute: Template.Execute Template.ExecuteTemplate Template.ExecuteTemplate: Template.ExecuteTemplate CVE-2026-94448 CVE-2026-94448: CVE-2026-94448 Reference Links Reference Links: Reference Links Feedback Feedback: Feedback Footer Footer: Footer Navigation Bar Navigation Bar: Navigation Bar Search Box Search Box: Search Box Community Community: Community Docs Docs: Docs Learn Learn: Learn Packages Packages: Packages Why Go Why Go: Why Go Vulnerability Database Vulnerability Database: Vulnerability Database All Reports All Reports: All Reports GO-2026-6599 GO-2026-6599: GO-2026-6599 Standard Library Standard Library: Standard Library Template.Execute Template.Execute: Template.Execute Template.ExecuteTemplate Template.ExecuteTemplate: Template.ExecuteTemplate CVE-2026-94448 CVE-2026-94448: CVE-2026-94448 Reference Links Reference Links: Reference Links Feedback Feedback: Feedback Footer Footer: Footer Navigation Bar Navigation Bar: Navigation Bar Search Box Search Box: Search Box Community Community: Community Docs Docs: Docs Learn Learn: Learn Packages Packages: Packages Why Go Why Go: Why Go Vulnerability Database Vulnerability Database: Vulnerability Database All Reports All Reports: All Reports GO-2026-6599 GO-2026-6599: GO-2026-6599 Standard Library Standard Library: Standard Library Template.Execute Template.Execute: Template.Execute Template.ExecuteTemplate Template.ExecuteTemplate: Template.ExecuteTemplate CVE-2026-94448 CVE-2026-94448: CVE-2026-94448 Reference Links Reference Links: Reference Links Feedback Feedback: Feedback Footer Footer: Footer Navigation Bar Navigation Bar: Navigation Bar Search Box Search Box: Search Box Community Community: Community Docs Docs: Docs Learn Learn: Learn Packages Packages: Packages Why Go Why Go: Why Go Vulnerability Database Vulnerability Database: Vulnerability Database All Reports All Reports: All Reports GO-2026-6599 GO-2026-6599: GO-2026-6599 Standard Library Standard Library: Standard Library Template.Execute Template.Execute: Template.Execute Template.ExecuteTemplate Template.ExecuteTemplate: Template.ExecuteTemplate CVE-2026-94448 CVE-2026-94448: CVE-2026-94448 Reference Links Reference Links: Reference Links Feedback Feedback: Feedback Footer Footer: Footer Navigation Bar Navigation Bar: Navigation Bar Search Box Search Box: Search Box Community Community: Community Docs Docs: Docs Learn L

Goal Reached Thanks to every supporter — we hit 100%!

Go html/template XSS Vulnerability Advisory (GO-2026-6599/CVE-2026-94448)

More from this source