Repository navigation
html/template: XSS via stale jsCtx at template-literal expression entry, tJSTmpl ${ #81821
Description
html/template: reset context tracking on consecutive template expressions
When a JavaScript template literal contains
consecutive expressions, the context tracking
state was not properly reset upon entering a
new expression.
We now ensure that template-literal expression
entries correctly reset context variables so all
subsequent regular expression literals are
accurately recognized and escaped.
This is CVE-2026-94448 and Go issue https://go.dev/issue/81821.
This was a PUBLIC track issue originally tracked in http://b/545173298.
Activity
gabyhelp commentedon Sep 28, 2026
Related Issues
Related Code Changes
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
gopherbot commentedon Sep 28, 2026
Change https://go.dev/cl/839866 mentions this issue:
html/template: reset JS context for template expressionsthatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81923 (for 1.26), #81924 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
html/template: reset JS context for template expressions
gopherbot commentedon Oct 1, 2026
Change https://go.dev/cl/843225 mentions this issue:
html/template: reset JS context for template expressionsgopherbot commentedon Oct 1, 2026
Change https://go.dev/cl/843187 mentions this issue:
html/template: reset JS context for template expressions[release-branch.go1.27] html/template: reset JS context for template …
[release-branch.go1.26] html/template: reset JS context for template …