CVE-2026-94448

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user's browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.

A MODERATE severity cross-site scripting (XSS) vulnerability was found in Go's html/template package, which is shipped and used across multiple Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset), Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and other components that build against the Go toolchain. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state upon entering a new expression. As a result, subsequent regular expression literals are not accurately recognized and escaped, allowing a remote attacker to supply untrusted content through a template that bypasses html/template sanitization and executes malicious script in a victim's browser. Successful exploitation requires a victim user to visit a rendered page of a Go web application that interpolates attacker-controlled input into JavaScript template literals. Red Hat has rated this flaw MODERATE with a CVSS 3.1 score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream assessment; the impact is limited to low confidentiality and integrity loss within the client browser context, with no availability impact. Because the CVSS score is below 7.0, the fix is deferred for the affected Red Hat product streams and update trackers are not being filed for this MODERATE severity flaw at this time. The residual risk is limited to Go-based web applications that render attacker-controlled content through html/template into JavaScript contexts; the flaw does not affect applications that do not use html/template with JavaScript template literals.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.