html/template: JS template literal context incorrectly tracked

[neild]

Context was not properly tracked across template branches for JS template
literals, leading to possibly incorrect escaping of content when branches were
used.
 
Additionally template actions within JS template literals did not properly track
the brace depth, leading to incorrect escaping being applied.
 
These issues could cause actions within JS template literals to be incorrectly
or improperly escaped, leading to XSS vulnerabilities.
 
This only affects templates that use template actions within JS template literals.
 
 
This is CVE-2026-32289 and Go issue https://go.dev/issue/78331.

---

This is a PRIVATE issue for CVE-2026-32289, tracked in http://b/491530416 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3882.

/cc @golang/security and @golang/release

[neild]

@gopherbot please open backport issues for this security fix

[gopherbot]

Backport issue(s) opened: #78416 (for 1.25), #78417 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/763543 mentions this issue: [release-branch.go1.26] html/template: properly track JS template literal brace depth across contexts

[gopherbot]

Change https://go.dev/cl/763551 mentions this issue: [release-branch.go1.25] html/template: properly track JS template literal brace depth across contexts

[gopherbot]

Change https://go.dev/cl/763762 mentions this issue: html/template: properly track JS template literal brace depth across contexts