CVE-2026-94448: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Go standard library html/template

The vulnerability arises because the context tracking state in the html/template package was not properly reset upon entering a new expression within JavaScript template literals containing consecutive expressions. This improper neutralization of input during web page generation (CWE-79) can result in incorrect escaping of regular expression literals following these expressions. The fix ensures that template-literal expression entries correctly reset context variables so that all subsequent regular expression literals are accurately recognized and escaped.

If exploited, this vulnerability could allow an attacker to inject malicious JavaScript code into web pages generated using the affected versions of the Go html/template package, leading to cross-site scripting attacks. This could compromise the security of users by executing arbitrary scripts in their browsers. However, there are no known exploits in the wild at this time.

A fix is available in Go standard library versions 1.26.9 and 1.27.2 and later. Users should upgrade to these or later versions to mitigate this vulnerability. Since this is a library vulnerability, updating the affected versions of the html/template package is the recommended remediation.