CVE-2026-94448 Go standard library CVE debrief

Who should care

Defenders responsible for Go applications using the html/template package should assess exposure, especially if their applications handle JavaScript template literals with consecutive expressions.

Why it matters

CVE-2026-94448 involves a context tracking issue in the Go standard library's html/template package. Defenders should review and update affected Go applications, assess exposure, and verify context tracking state reset for accurate regular expression literal handling.

• Review and update affected Go applications to prevent potential issues with regular expression literal recognition and escaping
• Assess exposure of JavaScript template literals with consecutive expressions in Go applications
• Verify context tracking state reset in Go html/template package for accurate regular expression literal handling

Technical summary

The Go standard library's html/template package has a context tracking issue when handling consecutive expressions in JavaScript template literals. This could lead to inaccurate recognition and escaping of regular expression literals. Defenders should review and update affected Go applications, assess exposure, and verify context tracking state reset for accurate regular expression literal handling. The issue arises when consecutive expressions are present in a JavaScript template literal, leading to improper context tracking state reset.

Defensive priority

Defenders should prioritize reviewing and updating Go applications that utilize the affected html/template package, especially those handling JavaScript template literals with consecutive expressions.

Recommended defensive actions

• Review Go applications using the affected html/template package
• Update to version 1.26.9 or 1.27.2
• Assess exposure of JavaScript template literals with consecutive expressions
• Verify context tracking state reset in Go html/template package for accurate regular expression literal handling
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the context tracking issue in the Go standard library's html/template package. It mentions that the state was not properly reset upon entering a new expression in JavaScript template literals, potentially affecting the accuracy of regular expression literal recognition and escaping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.