CVE-2026-94448: Golang Package Vulnerability in HTML Template Context Tracking
Summary
CVE-2026-94448: Reset context tracking on consecutive template expressions in html/template. Affects golang across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-94448 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications. The language's html/template package allows developers to safely generate HTML output from templates. However, it is susceptible to vulnerabilities that can compromise the integrity of the generated content, particularly in handling JavaScript template literals.
Vulnerability Detail
The vulnerability arises from improper context tracking when processing consecutive expressions within JavaScript template literals. This oversight can lead to incorrect recognition and escaping of subsequent regular expression literals, potentially allowing for injection attacks or unintended behavior in web applications. The issue was identified in the context tracking state not being reset correctly, which could expose applications to security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9 -
>= 1.27.0-0, < 1.27.21.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid using consecutive expressions in JavaScript template literals until the package is updated. This can help mitigate the risk of context tracking issues while a permanent fix is being implemented.
Conclusion
In summary, CVE-2026-94448 is a significant vulnerability in the Golang package that affects the handling of JavaScript template literals. It is crucial for developers to update to the patched versions to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang →
FAQ
CVE-2026-94448 is a vulnerability in the Golang package related to improper context tracking in HTML template processing.
This vulnerability can lead to incorrect escaping of regular expression literals, potentially allowing for injection attacks or other unintended behaviors in web applications.
The vulnerability affects all versions prior to 1.26.9 and 1.27.2, including versions 1.27.0-0 and below.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing the workaround by avoiding consecutive expressions in JavaScript template literals.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
