CVE-2026-94448: Go stdlib Package Vulnerability in html/template Context Tracking
Summary
CVE-2026-94448: Reset context tracking on consecutive template expressions in html/template. Affects stdlib across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-94448 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library (stdlib) is a collection of packages that provide essential functionality for Go applications. Among these packages, 'html/template' is designed for safely generating HTML output by escaping data to prevent injection attacks. This package is widely used in web applications to render dynamic content. However, it is susceptible to a vulnerability that affects how context tracking is managed during template processing, potentially leading to incorrect handling of expressions.
Vulnerability Detail
The vulnerability arises when a JavaScript template literal contains consecutive expressions. In such cases, the context tracking state fails to reset correctly when entering a new expression. This oversight can lead to improper recognition and escaping of subsequent regular expression literals, which may expose applications to security risks such as injection attacks or incorrect data rendering. The issue has been identified and documented as GO-2026-6599.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get stdlib@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get stdlib@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid using consecutive expressions in JavaScript template literals until the package is updated. This may involve restructuring the template code to separate expressions or using alternative methods for rendering dynamic content.
Conclusion
The vulnerability identified as CVE-2026-94448 in the Go standard library's html/template package poses significant risks related to context tracking in template processing. It is crucial for developers to update to the latest patched versions to ensure the security and integrity of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability involves improper context tracking in the html/template package when handling consecutive expressions in JavaScript template literals.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
The risks include incorrect data rendering and potential injection attacks due to improper escaping of regular expression literals.
Yes, it is recommended to upgrade to version 1.26.9 or 1.27.2 of the Go standard library to mitigate this vulnerability.
If an immediate update is not possible, consider restructuring your template code to avoid using consecutive expressions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
