CVE-2026-32289
ADVISORY - golangSummary
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.
These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
Common Weakness Enumeration (CWE)
GoLang
CREATED
UPDATED
ADVISORY IDGO-2026-4865
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| stdlib | golang | - | - | >=1.26.0-0,<1.26.2 | 1.26.2 |
| stdlib | golang | - | - | <1.25.9 | 1.25.9 |
Severity and metrics
No CVSS data available from this advisory.