CLEANSTART-2026-FF43574 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

CLEANSTART-2026-GZ31996 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the temporal-server package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-HM16976 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the docker-cli-buildx package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-BX15476 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

CLEANSTART-2026-QB75766 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the containerd package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-DP89465 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the minio-operator package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals

A flaw was found in the html/template package. This vulnerability arises from improper tracking of context and brace depth within JavaScript JS template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting...

html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals

A flaw was found in the html/template package. This vulnerability arises from improper tracking of context and brace depth within JavaScript JS template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting...

html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals

A flaw was found in the html/template package. This vulnerability arises from improper tracking of context and brace depth within JavaScript JS template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting...

AZL-98763 CVE-2026-32289 affecting package golang 1.27.1-1

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being...

CVE-2026-32289: Improper Neutralization of Input During Web Page Generation

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being...

CVE-2023-29453

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...

GitLab: Snippet JS template allows attacker to read a user's private snippets

These days snippets can be embedded in a site other than the GitLab instance. An embed link is only generated for public snippets, as can be seen in the app/views/shared/snippets/header.html.haml: haml - if publicsnippet? .embed-snippet .input-group .input-group-btn %button.btn.embed-toggle...