Go html/template CVE-2026-94448

Requires a Go application using html/template whose template includes a JavaScript template literal (backtick string) with consecutive '${...}' expressions followed by a regular-expression literal, with attacker-influenced data rendered into that context; the failure to reset context variables causes the subsequent regex literal to be escaped incorrectly, enabling injection. Limiting factors: this is confined to that specific JS-template-literal-plus-regex construct and is not triggered in ordinary HTML, attribute, or URL contexts; the application must pass untrusted data into the affected context and a victim must load the rendered page for XSS to fire. Not remotely exploitable against a default configuration without an application that both uses this template pattern and renders untrusted input.

No CVSS vector, EPSS score, KEV listing, POC, or SSVC data was supplied for CVE-2026-94448, so this assessment rests solely on the Go release announcement and go.dev/issue/81821. The flaw is an output-escaping correctness bug in Go's html/template: context-tracking state is not reset when a JavaScript template literal contains consecutive expressions, so a subsequent regular-expression literal may be escaped incorrectly, creating an XSS/injection exposure. Real-world risk is moderate-to-low despite Go's enormous deployment footprint, because exploitation requires a narrow and uncommon template construct (a JS template literal with consecutive '${...}' expressions immediately followed by a regex literal) AND untrusted data flowing into exactly that context - a pattern most Go web applications do not use. This is best characterized as a flaw in a ubiquitous product but with a rare trigger, i.e. low real-world exploitation likelihood rather than a widespread emergency. No exploitation signal (KEV/POC) is present, so routine patching via a Go toolchain upgrade is the appropriate priority, not an out-of-band emergency.

An attacker supplies crafted input to a Go web application whose html/template renders a JavaScript template literal containing consecutive expressions followed by a regex literal; because the context tracker is not reset, the attacker-controlled data in the regex-literal context is not correctly escaped, letting the payload break out and execute as script in victims' browsers. No public exploit code was identified at time of analysis, and success depends on the application actually containing this specific template pattern with attacker-influenced data.