CVE-2026-94448: 
Go Análise e mitigação de vulnerabilidades

CVE-2026-94448 is a Cross-Site Scripting (XSS) vulnerability in the Go standard library's html/template package, caused by improper context tracking state reset when processing consecutive expressions within JavaScript template literals. Affected versions include all Go releases before 1.26.9 and versions 1.27.0-0 through 1.27.2 (exclusive). It was published on October 8, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). When the html/template package processes JavaScript template literals containing consecutive expressions (e.g., `${expr1}${expr2}`), the context tracking state is not properly reset upon entering each new expression. This causes subsequent regular expression literals to be misidentified and incorrectly escaped, potentially allowing unescaped or maliciously crafted content to be injected into the rendered HTML output. The fix ensures that template-literal expression entries correctly reset context variables for each new expression (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an unauthenticated, network-based attacker to inject unescaped content into HTML pages generated by Go applications using the html/template package, resulting in low-severity confidentiality and integrity impacts (e.g., session hijacking, credential theft, or page content manipulation). User interaction is required, as a victim must visit or interact with a page rendering the malicious template output. Availability is not directly impacted, and the scope is changed, meaning the attack can affect resources beyond the vulnerable component itself (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction, limiting opportunistic attack scenarios (Red Hat Advisory, GitHub Advisory).

Update Go to version 1.26.9 or later (for the 1.26.x branch) or 1.27.2 or later (for the 1.27.x branch) to remediate this vulnerability. Developers should review any applications using the html/template package with consecutive JavaScript template literal expressions and test for correct escaping behavior after patching. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation (Red Hat Advisory, Red Hat Bugzilla).