CVE-2026-32289: Golang Package Vulnerability Leading to XSS via Improper Context Tracking in JS Template Literals
Summary
CVE-2026-32289: JsBraceDepth Context Tracking Bugs (XSS) in html/template. Affects golang across 2 version ranges.
< 1.25.9
>= 1.26.0-0, < 1.26.2
Fixed in 1.25.9 or 1.26.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-32289 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications. The language's html/template package is essential for rendering HTML and managing templates in web applications. However, this package has a vulnerability that affects how JavaScript template literals are processed, potentially exposing applications to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from improper context tracking across template branches in JavaScript template literals. When branches are used, the escaping of content may not be applied correctly, leading to potential XSS vulnerabilities. Additionally, template actions within these literals fail to track brace depth accurately, resulting in incorrect escaping. This could allow malicious scripts to be executed in the context of a user's browser, compromising the security of web applications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.25.91.25.9 -
>= 1.26.0-0, < 1.26.21.26.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider sanitizing user inputs and outputs to mitigate the risk of XSS attacks. Implementing a robust content security policy (CSP) can also help reduce the impact of potential vulnerabilities.
Conclusion
CVE-2026-32289 represents a significant security risk for applications using the Golang html/template package due to improper context tracking in JavaScript template literals. It is crucial for developers to update to the patched versions to safeguard their applications against potential XSS attacks.
See every vulnerability recorded for golang →
FAQ
CVE-2026-32289 is a vulnerability in the Golang package that affects the html/template functionality, leading to potential XSS attacks due to improper context tracking in JavaScript template literals.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can determine if your application is affected by this vulnerability.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the user's browser, potentially leading to data theft, session hijacking, or other malicious activities.
Yes, you can implement input sanitization and a content security policy (CSP) to help mitigate the risk of XSS attacks while you work on updating the package.
Detailed information about CVE-2026-32289 can be found on the official GitHub repository and security advisory pages related to Golang.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
