Medium severity · published Apr 8, 2026
CVE-2026-32289
JsBraceDepth Context Tracking Bugs (XSS) in html/template
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
html/template · Go standard library
before 1.25.9; 1.26.0-0 before 1.26.2 · source: vendor
GO
GO · Golang
before 1.25.9; 1.26.0 before 1.26.2 · source: NVD
Affected product
HT
html/template
Go standard library
More from html/template
6.1
CVE-2026-97030
Recognize yield as regexp preceder keyword in html/template
6.1
CVE-2026-94448
Reset context tracking on consecutive template expressions in html/template
6.1
CVE-2026-56858
Fix Javascript regexp context tracking in html/template
6.1
CVE-2026-39823
Bypass of meta content URL escaping causes XSS in html/template
6.1
CVE-2026-39826
Escaper bypass leads to XSS in html/template