CVE-2026-32289
mediumpriority · track · 24EPSS 0.003 · 21 %ileDEEUFRRUUSEPSS · scored 2026-10-27
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (129)
Products and version ranges known to be affected.
- Red Hat Ansible Automation Platform 2.5all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.5
- Red Hat Ansible Automation Platform 2.6all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6
- Red Hat Enterprise Linux 10.0 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:10.0_extended_update_support
- Red Hat Enterprise Linux 9.6 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:9.6_extended_update_support
- Red Hat Enterprise Linux Advanced Cluster Securityall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security
- Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
- Red Hat OpenShift API for Data Protectionall versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
- Red Hat OpenShift Network Observability 1.11.2all versionscert_bundDEcpe:/a:redhat:openshift:network_observability_1.11.2
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1006Golang Go: Mehrere SchwachstellenDeutsch2026-04-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- BIT-golang-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template2026-04-13vendor · osvUS
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- GO-2026-4865JsBraceDepth Context Tracking Bugs (XSS) in html/template2026-04-07vendor · osvUS
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202604-1883cnnvd
- EUVD-2026-20018enisa_euvd
- BDU:2026-07253fstec_bdu
- GHSA-7mr4-xjxg-34g6enisa_euvd
- BIT-golang-2026-32289osv
- GO-2026-4865osv
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://go.dev/cl/763762cnnvd
- https://go.dev/doc/devel/releasePatchcnnvd
- https://go.dev/issue/78331cnnvd
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWUcnnvd
- https://pkg.go.dev/vuln/GO-2026-4865cnnvd
- https://go.dev/cl/763762enisa_euvd
- https://go.dev/issue/78331enisa_euvd
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWUenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan