CVE-2026-32289

MEDIUM EPSS 20.7%
Published Apr 8, 20262mo ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Apr 8, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
golanggo* <1.25.9
golanggo*≥1.26.0  –  <1.26.2

References 4

  • go.dev https://go.dev/cl/763762
    Patch
  • go.dev https://go.dev/issue/78331
    Issue Tracking
  • groups.google.com https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
    Mailing ListRelease Notes
  • pkg.go.dev https://pkg.go.dev/vuln/GO-2026-4865
    Vendor Advisory

Remediation

  • go.dev https://go.dev/cl/763762
    Patch