AZL-98763 CVE-2026-32289 affecting package golang 1.27.1-1

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being...

CVE-2023-29453

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...

GitLab: Snippet JS template allows attacker to read a user's private snippets

These days snippets can be embedded in a site other than the GitLab instance. An embed link is only generated for public snippets, as can be seen in the app/views/shared/snippets/header.html.haml: haml - if publicsnippet? .embed-snippet .input-group .input-group-btn %button.btn.embed-toggle...