---
id: CVE-2026-32289
title: >-
html/template: golang: html/template: Cross-Site Scripting (XSS) via improper
context and brace depth tracking in JS template literals (CVE…
summary: >-
A flaw was found in the `html/template` package. This vulnerability arises
from improper tracking of context and brace depth within JavaScript (JS)
template literals. A remote attacker could exploit these issues to cause
content to be inco…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-79
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
- assisted_installer_for_red_hat_openshift_container_platform 2
- builds_for_red_hat_openshift
- cert_manager_operator_for_red_hat_openshift
- compliance_operator
- confidential_compute_attestation
- cryostat 4
- custom_metric_autoscaler_operator_for_red_hat_openshift
- deployment_validation_operator
- external_secrets_operator_for_red_hat_openshift
- externaldns_operator
- file_integrity_operator
- gatekeeper 3
- logging_subsystem_for_red_hat_openshift
- logical_volume_manager_storage
- migration_toolkit_for_applications 8
- migration_toolkit_for_containers
- multiarch_tuning_operator
- multicluster_engine_for_kubernetes
- multicluster_global_hub
- network_observability_operator
- openshift_api_for_data_protection
- openshift_developer_tools_and_services
- openshift_lightspeed
- openshift_pipelines
- openshift_serverless
- openshift_service_mesh 2
- openshift_service_mesh 3
- power_monitoring_for_red_hat_openshift
- 3scale_api_management_platform 2
- advanced_cluster_management_for_kubernetes 2
- advanced_cluster_security 4
- ansible_automation_platform 2
- ceph_storage 5
- ceph_storage 6
- certification_program_for_red_hat_enterprise_linux 9
- connectivity_link 1
- developer_hub
- edge_manager 1
- enterprise_linux 10
- enterprise_linux 7
patched:
- enterprise_linux_appstream_v_9
- hardened_images
published: '2026-04-08'
updated: '2026-09-07'
sourceUpdated: '2026-09-07T13:46:14+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json'
references:
- url: >-
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json
- url: 'https://access.redhat.com/security/cve/CVE-2026-32289'
- url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2456334'
- url: 'https://www.cve.org/CVERecord?id=CVE-2026-32289'
- url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32289'
- url: 'https://go.dev/cl/763762'
- url: 'https://go.dev/issue/78331'
- url: 'https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU'
- url: 'https://pkg.go.dev/vuln/GO-2026-4865'
- url: 'https://access.redhat.com/errata/RHSA-2026:19181'
- url: 'https://access.redhat.com/errata/RHSA-2026:7385'
- url: 'https://access.redhat.com/errata/RHSA-2026:7291'
tags:
- csaf
- vex
- red-hat
- osv
- go
epss: 0.0029
epssPercentile: 0.21836
aliases:
- GO-2026-4865
- BIT-golang-2026-32289
ecosystem: go
ingestedAt: '2026-07-10T18:56:50.796Z'
---
## Overview
A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting (XSS) vulnerabilities. This could allow an attacker to inject malicious scripts into web pages viewed by other users.
## Vendor advisories
- **RHSA-2026:19181** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19181)
- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)
- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)
- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Red Hat Enterprise Linux 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, … · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32289.json)
**html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals** — rated Moderate by Red Hat. Released 2026-04-08, updated 2026-09-07.
Affected:
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Compliance Operator
- Confidential Compute Attestation
- Cryostat 4
- Custom Metric Autoscaler operator for Red Hat Openshift
- Deployment Validation Operator
- External Secrets Operator for Red Hat OpenShift
- ExternalDNS Operator
- File Integrity Operator
- Gatekeeper 3
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- Multiarch Tuning Operator
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Network Observability Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Connectivity Link 1
- Red Hat Developer Hub
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
Fixed:
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Hardened Images
No fix planned:
- Red Hat Enterprise Linux 9
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Compliance Operator
- Confidential Compute Attestation
- Cryostat 4
- Custom Metric Autoscaler operator for Red Hat Openshift
- Deployment Validation Operator
- External Secrets Operator for Red Hat OpenShift
- ExternalDNS Operator
- File Integrity Operator
- Gatekeeper 3
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- Multiarch Tuning Operator
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Network Observability Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Connectivity Link 1
- Red Hat Developer Hub
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
## Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:19181
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7385
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7291
Workarounds / mitigations:
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
## Package advisory (CVE-2026-32289)
Affected packages:
- `stdlib >= 1.26.0-0, < 1.26.2`
Patched in:
- `stdlib 1.26.2`
Source: https://osv.dev/vulnerability/GO-2026-4865