medium 6.1

CVE-2026-32289 json

JsBraceDepth Context Tracking Bugs (XSS) in html/template

published 2026-04-07 7 mo ago modified 2026-10-07 32 d ago also BIT-golang-2026-32289 , EUVD-2026-20018 , GO-2026-4865

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

Patch / fix

fixed in 3 distros 6 links 1

bitnami golang 1.25.9, 1.26.2
go stdlib 1.25.9, 1.26.2
Go standard library html/template 1.25.9, 1.26.2

debian red hat suse opensuse almalinux alpine

golang-1.26 Debian 14 1.26.2-1

debian advisories DEBIAN-CVE-2026-32289

delve RHEL 8 1.25.2-1.module+el8.10.0+23746+9db33b5e
golang RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
go-toolset RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
golang-bin RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
golang-src RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
golang-misc RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
golang-race RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
golang-tests RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7

red hat advisories RHSA-2026:22112 RHSA-2026:7385 RHSA-2026:7291 RHSA-2026:10217 RHSA-2026:10219

go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.12-160000.1.1
go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.4-160000.1.1
go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.9-150000.1.21.1
go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.2-150000.1.6.1
go1.25 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.25.9-150000.1.35.1
go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.2-150000.1.9.1

suse advisories SUSE-SU-2026:22638-1 SUSE-SU-2026:22572-1 SUSE-SU-2026:1581-1 SUSE-SU-2026:1580-1 SUSE-SU-2026:1321-1 SUSE-SU-2026:1320-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
go1.25-openssl openSUSE Leap 16.0 1.25.12-160000.1.1
go1.26-openssl openSUSE Leap 16.0 1.26.4-160000.1.1
go1.26 openSUSE Leap 16.0 1.26.2-160000.1.1
go1.25 openSUSE Leap 16.0 1.25.9-160000.1.1
go1.26 openSUSE Tumbleweed 1.26.2-1.1
go1.25 openSUSE Tumbleweed 1.25.9-1.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2026:21319-1 openSUSE-SU-2026:21254-1 openSUSE-SU-2026:20571-1 openSUSE-SU-2026:20570-1 openSUSE-SU-2026:10525-1

delve AlmaLinux 8 1.25.2-1.module_el8.10.0+4074+24330916
golang AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
go-toolset AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
golang-bin AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
golang-src AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
golang-misc AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
golang-race AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
golang-tests AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4

almalinux advisories ALSA-2026:22112

go Alpine 3.23 1.25.9-r0
go Alpine 3.24 1.26.2-r0
rclone Alpine 3.24 1.73.5-r0

alpine advisories ALPINE-CVE-2026-32289

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

go.dev/cl/763762 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32289 updated 2026-11-05 cvss 5.4

html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 redhat-user-workloads/crt-nshift-appliance-tenant/appliance/appliance Red Hat Builds for Red Hat OpenShift redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-6, redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-7 Red Hat cert-manager Operator for Red Hat OpenShift redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-17/jetstack-cert-manager-1-17, redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-18/jetstack-cert-manager-1-18 Red Hat Compliance Operator redhat-user-workloads/ocp-isc-tenant/compliance-operator-bundle-release Red Hat Confidential Compute Attestation redhat-user-workloads/ose-osc-tenant/osc-caa, redhat-user-workloads/ose-osc-tenant/trustee/trustee-operator Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9

+34 more productsfewer

Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-adapter Red Hat Deployment Validation Operator redhat-user-workloads/dvo-obsint-tenant/deployment-validation-operator/deployment-validation-operator Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9 Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9 Red Hat File Integrity Operator redhat-user-workloads/ocp-isc-tenant/file-integrity-operator-release Red Hat Gatekeeper 3 redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-18/gatekeeper-operator-3-18, redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-20/gatekeeper-operator-3-20 Red Hat Logging Subsystem for Red Hat OpenShift redhat-user-workloads/ocp-art-tenant/art-images, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-0, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-2, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-4 Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel8, lvms4/topolvm-rhel9, redhat-user-workloads/logical-volume-manag-tenant/lvm-operator Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, redhat-user-workloads/ocp-art-tenant/art-images Red Hat Migration Toolkit for Containers redhat-user-workloads/ocp-art-tenant/art-images Red Hat Multiarch Tuning Operator redhat-user-workloads/multiarch-tuning-ope-tenant/multiarch-tuning-operator-v1-x/multiarch-tuning-operator-v1-x Red Hat Multicluster Engine for Kubernetes redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-28, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-29, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-210, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-211, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-26/kube-rbac-proxy-mce-26, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-27/kube-rbac-proxy-mce-27 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8, multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Network Observability Operator redhat-user-workloads/ocp-network-observab-tenant/flowlogs-pipeline-zstream Red Hat OpenShift API for Data Protection redhat-user-workloads/ocp-art-tenant/art-images Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Lightspeed redhat-user-workloads/crt-nshift-lightspeed-tenant/openshift-mcp-server Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-clients, redhat-user-workloads/ocp-serverless-tenant/serverless-operator-137/kn-plugin-event-sender Red Hat OpenShift Service Mesh 2 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/kiali-2-6 Red Hat OpenShift Service Mesh 3 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/kiali-3-0, redhat-user-workloads/service-mesh-tenant/kiali-3-1, redhat-user-workloads/service-mesh-tenant/kiali-3-2, redhat-user-workloads/service-mesh-tenant/kiali-3-3 Red Hat Power monitoring for Red Hat OpenShift redhat-user-workloads/rhpm-tenant/kepler Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/volsync-tenant/volsync-0-13, redhat-user-workloads/volsync-tenant/volsync-0-14, redhat-user-workloads/volsync-tenant/volsync-0-15 Red Hat Advanced Cluster Security 4 rhacs-eng/release-main Red Hat Ansible Automation Platform 2 receptor, automation-gateway-proxy, automation-gateway-proxy-openssl30, automation-gateway-proxy-openssl32, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/receptor-rhel9 Red Hat Ceph Storage 5 rhceph-ci/grafana Red Hat Ceph Storage 6 rhceph-ci/grafana Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Connectivity Link 1 redhat-user-workloads/api-management-tenant/rhcl-1-3-coredns Red Hat Developer Hub 1 rhdh/rhdh-rhel9-operator Red Hat Edge Manager 1 flightctl, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-api Red Hat Enterprise Linux 7 rhc, rhc-worker-script Red Hat Enterprise Linux 8 rhc, conmon, podman, skopeo, buildah, grafana, +31 more

affected: workaround, no fix available “Fix deferred”

27 more affected, 6 more fixed in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-13)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	<1.25.9 >=1.26.0-0, <1.26.2	1.25.9 1.26.2
go	stdlib	<1.25.9 >=1.26.0-0, <1.26.2	1.25.9 1.26.2

Affected products

Go standard library html/template

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

go.dev /cl/763762
patch
pkg.go.dev /vuln/GO-2026-4865
vendor-advisory, advisory
go.dev /issue/78331
issue-tracking, report
groups.google.com /g/golang-announce/c/0uYbvbPZRWU
mailing-list, release-notes, discussion, web
nvd.nist.gov /vuln/detail/CVE-2026-32289
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary