CVE-2026-94448: 
Go 脆弱性分析と緩和策

CVE-2026-94448 is a Cross-Site Scripting (XSS) vulnerability in the Go standard library's html/template package, caused by improper context tracking when processing consecutive expressions within JavaScript template literals. When multiple expressions appear consecutively in a template literal, the context tracking state is not properly reset upon entering each new expression, causing subsequent regular expression literals to be incorrectly recognized and potentially left unescaped. Affected versions include Go html/template prior to 1.26.9 (in the 1.26.x branch) and prior to 1.27.2 (in the 1.27.x branch). It was published on October 8, 2026, with patches released the same day. The CVSS v3.1 base score is 6.1 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The flaw resides in the context-tracking logic of Go's html/template package: when a JavaScript template literal contains consecutive interpolated expressions (e.g., `${expr1}${expr2}`), the parser fails to reset internal context state variables between expressions, causing the template engine to misidentify subsequent regular expression literals and skip proper escaping (Github Advisory, Red Hat Bugzilla). The fix, tracked in Go issue #81821 and applied via CL #839866, ensures template-literal expression entries correctly reset context variables. Exploitation requires an attacker to control or influence template input and requires user interaction (e.g., a victim visiting a page rendering the malicious template output).

Successful exploitation allows an attacker to inject unescaped content into HTML output generated by Go applications using the html/template package, enabling XSS attacks. This can result in theft of session cookies, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the user's browser context, though availability is not directly affected (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.181% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for user interaction.

1. Identify a target application: Find a Go web application using the html/template package (versions < 1.26.9 or 1.27.0–1.27.1) that renders user-controlled or attacker-influenced data within JavaScript template literals containing consecutive expressions.
2. Craft a malicious payload: Construct input that, when embedded as a consecutive expression in a JavaScript template literal (e.g., `${userInput1}${maliciousInput}`), exploits the context-reset flaw to cause the template engine to misclassify a subsequent regex literal and leave it unescaped.
3. Inject the payload: Submit the crafted input through an application input vector (e.g., form field, URL parameter, or stored data) that is reflected or stored and later rendered in a template literal context.
4. Trigger victim interaction: Lure a victim user to visit the page or endpoint that renders the malicious template output (e.g., via phishing link or stored XSS trigger).
5. Execute arbitrary JavaScript: The victim's browser executes the injected script, enabling session hijacking, credential theft, DOM manipulation, or further attacks (Github Advisory, Red Hat Bugzilla).

• Logs: Unexpected JavaScript payloads (e.g., <script>, onerror=, javascript:) appearing in application access logs within parameters or fields rendered inside JavaScript template literals.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after loading pages that use Go html/template with consecutive template literal expressions; unusual data exfiltration via query parameters or POST bodies.
• Application Behavior: Reports of unexpected script execution, session anomalies, or unauthorized actions in Go-based web applications using the affected html/template versions (< 1.26.9 or < 1.27.2).

Upgrade the Go runtime to version 1.26.9 or later (for the 1.26.x branch) or 1.27.2 or later (for the 1.27.x branch), which include the fix for improper context reset in template literal expression handling (Github Advisory, Red Hat Bugzilla). No configuration-based workaround is documented; upgrading is the recommended and only reliable remediation. After patching, review and test applications that use html/template with consecutive template literal expressions to confirm correct escaping behavior.

The vulnerability was covered in the context of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws, with CVE-2026-94448 noted among the Go-related issues (BleepingComputer). SUSE issued security updates (SUSE-SU-2026:4625-1 and SUSE-SU-2026:4629-1) addressing this CVE, and Mageia and AusCERT also published advisories. The Hugo static site generator released v0.168.0 incorporating the fix. Community reaction has been measured, consistent with a medium-severity library vulnerability with no active exploitation.