Red Hat EUVD-2026-20018

Go's html/template package provides automatic context-aware HTML escaping for template variables. The vulnerability stems from two distinct flaws in how the template parser handles JavaScript (JS) template literals (backtick-delimited strings in JavaScript that support embedded expressions via ${...} syntax). First, context state is not properly maintained when template execution branches (if/else, range, etc.) occur within JS template literals, causing the escaper to apply incorrect HTML or JavaScript escaping rules. Second, the template action parser fails to correctly track nested brace depth within JS template literals, leading to improper demarcation of template action boundaries and subsequent incorrect escaping. JS template literals are a modern JavaScript feature that creates a complex escaping challenge because content inside ${...} expressions requires JavaScript context awareness, yet the surrounding literal requires different escaping rules. The CWE classification is not provided, but this aligns with improper input neutralization patterns common to XSS vulnerabilities.