{"id":"CVE-2026-32289","title":"html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…","summary":"A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be inco…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-79","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","compliance_operator","confidential_compute_attestation","cryostat 4","custom_metric_autoscaler_operator_for_red_hat_openshift","deployment_validation_operator","external_secrets_operator_for_red_hat_openshift","externaldns_operator","file_integrity_operator","gatekeeper 3","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","migration_toolkit_for_applications 8","migration_toolkit_for_containers","multiarch_tuning_operator","multicluster_engine_for_kubernetes","multicluster_global_hub","network_observability_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_pipelines","openshift_serverless","openshift_service_mesh 2","openshift_service_mesh 3","power_monitoring_for_red_hat_openshift","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","ceph_storage 5","ceph_storage 6","certification_program_for_red_hat_enterprise_linux 9","connectivity_link 1","developer_hub","edge_manager 1","enterprise_linux 10","enterprise_linux 7"],"patched":["enterprise_linux_appstream_v_9","hardened_images"],"published":"2026-04-08","updated":"2026-09-07","sourceUpdated":"2026-09-07T13:46:14+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32289"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456334"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32289"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289"},{"url":"https://go.dev/cl/763762"},{"url":"https://go.dev/issue/78331"},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"},{"url":"https://pkg.go.dev/vuln/GO-2026-4865"},{"url":"https://access.redhat.com/errata/RHSA-2026:19181"},{"url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"url":"https://access.redhat.com/errata/RHSA-2026:7291"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.0029,"epssPercentile":0.21835,"aliases":["GO-2026-4865","BIT-golang-2026-32289"],"ecosystem":"go","ingestedAt":"2026-07-10T18:56:50.796Z","slug":"CVE-2026-32289","body":"## Overview\n\nA flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting (XSS) vulnerabilities. This could allow an attacker to inject malicious scripts into web pages viewed by other users.\n\n## Vendor advisories\n\n- **RHSA-2026:19181** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19181)\n- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)\n- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Red Hat Enterprise Linux 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, … · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json)\n\n**html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals** — rated Moderate by Red Hat. Released 2026-04-08, updated 2026-09-07.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 9\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:19181\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7385\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7291\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-32289)\n\nAffected packages:\n\n- `stdlib >= 1.26.0-0, < 1.26.2`\n\nPatched in:\n\n- `stdlib 1.26.2`\n\nSource: https://osv.dev/vulnerability/GO-2026-4865","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5088,"id":"CVE-2026-32289","ts":1788887248038,"field":"cvss","old":null,"new":"5.4"},{"seq":5087,"id":"CVE-2026-32289","ts":1788887248038,"field":"severity","old":"none","new":"medium"},{"seq":3971,"id":"CVE-2026-32289","ts":1788886363679,"field":"cvss","old":"5.4","new":null},{"seq":3970,"id":"CVE-2026-32289","ts":1788886363679,"field":"severity","old":"medium","new":"none"},{"seq":3252,"id":"CVE-2026-32289","ts":1788883138259,"field":"cvss","old":null,"new":"5.4"},{"seq":3251,"id":"CVE-2026-32289","ts":1788883138259,"field":"severity","old":"none","new":"medium"}]}