JavaScript Template Literal Vulnerability in Go Language Implementation

CVE-2026-32289

What is CVE-2026-32289?

A vulnerability exists in the Go programming language due to improper tracking of context across template branches for JavaScript template literals. This flaw primarily affects how content is escaped during rendering. When branches within these templates are utilized, there can be incorrect escaping, which may inadvertently lead to Cross-Site Scripting (XSS) vulnerabilities. Additionally, failures in tracking brace depth within template actions further exacerbate the issue, posing significant risks in scenarios where user input is involved. Developers utilizing these versions of Go must review their code to ensure proper management of template literals to mitigate potential security risks.

References