CVE-2026-32289 json
JsBraceDepth Context Tracking Bugs (XSS) in html/template
published 7mo ago modified last mo. also BIT-golang-2026-32289 , EUVD-2026-20018 , GO-2026-4865
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
Patch / fix
- bitnami golang 1.25.9, 1.26.2
- go stdlib 1.25.9, 1.26.2
- Go standard library html/template 1.25.9, 1.26.2
- golang-1.26 Debian 14 1.26.2-1
debian advisories DEBIAN-CVE-2026-32289
- delve RHEL 8 1.25.2-1.module+el8.10.0+23746+9db33b5e
- golang RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- go-toolset RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-bin RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-src RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-misc RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-race RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-tests RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
red hat advisories RHSA-2026:22112RHSA-2026:7385RHSA-2026:7291RHSA-2026:10217RHSA-2026:10219
- go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.12-160000.1.1
- go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.4-160000.1.1
- go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.9-150000.1.21.1
- go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.2-150000.1.6.1
- go1.25 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.25.9-150000.1.35.1
- go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.2-150000.1.9.1
suse advisories SUSE-SU-2026:22638-1SUSE-SU-2026:22572-1SUSE-SU-2026:1581-1SUSE-SU-2026:1580-1SUSE-SU-2026:1321-1SUSE-SU-2026:1320-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- go1.25-openssl openSUSE Leap 16.0 1.25.12-160000.1.1
- go1.26-openssl openSUSE Leap 16.0 1.26.4-160000.1.1
- go1.26 openSUSE Leap 16.0 1.26.2-160000.1.1
- go1.25 openSUSE Leap 16.0 1.25.9-160000.1.1
- go1.26 openSUSE Tumbleweed 1.26.2-1.1
- go1.25 openSUSE Tumbleweed 1.25.9-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21319-1openSUSE-SU-2026:21254-1openSUSE-SU-2026:20571-1openSUSE-SU-2026:20570-1openSUSE-SU-2026:10525-1
- delve AlmaLinux 8 1.25.2-1.module_el8.10.0+4074+24330916
- golang AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- go-toolset AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-bin AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-src AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-misc AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-race AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-tests AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
almalinux advisories ALSA-2026:22112
- go Alpine 3.23 1.25.9-r0
- go Alpine 3.24 1.26.2-r0
- rclone Alpine 3.24 1.73.5-r0
alpine advisories ALPINE-CVE-2026-32289
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go.dev/cl/763762 patch
Is CVE-2026-32289 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-32289 updated cvss 5.4
html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 redhat-user-workloads/crt-nshift-appliance-tenant/appliance/appliance Red Hat Builds for Red Hat OpenShift redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-6, redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-7 Red Hat cert-manager Operator for Red Hat OpenShift redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-17/jetstack-cert-manager-1-17, redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-18/jetstack-cert-manager-1-18 Red Hat Compliance Operator redhat-user-workloads/ocp-isc-tenant/compliance-operator-bundle-release Red Hat Confidential Compute Attestation redhat-user-workloads/ose-osc-tenant/osc-caa, redhat-user-workloads/ose-osc-tenant/trustee/trustee-operator Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9affected: workaround, no fix available “Fix deferred”
+34 more productsfewer
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-adapter Red Hat Deployment Validation Operator redhat-user-workloads/dvo-obsint-tenant/deployment-validation-operator/deployment-validation-operator Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9 Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9 Red Hat File Integrity Operator redhat-user-workloads/ocp-isc-tenant/file-integrity-operator-release Red Hat Gatekeeper 3 redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-18/gatekeeper-operator-3-18, redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-20/gatekeeper-operator-3-20 Red Hat Logging Subsystem for Red Hat OpenShift redhat-user-workloads/ocp-art-tenant/art-images, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-0, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-2, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-4 Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel8, lvms4/topolvm-rhel9, redhat-user-workloads/logical-volume-manag-tenant/lvm-operator Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, redhat-user-workloads/ocp-art-tenant/art-images Red Hat Migration Toolkit for Containers redhat-user-workloads/ocp-art-tenant/art-images Red Hat Multiarch Tuning Operator redhat-user-workloads/multiarch-tuning-ope-tenant/multiarch-tuning-operator-v1-x/multiarch-tuning-operator-v1-x Red Hat Multicluster Engine for Kubernetes redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-28, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-29, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-210, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-211, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-26/kube-rbac-proxy-mce-26, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-27/kube-rbac-proxy-mce-27 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8, multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Network Observability Operator redhat-user-workloads/ocp-network-observab-tenant/flowlogs-pipeline-zstream Red Hat OpenShift API for Data Protection redhat-user-workloads/ocp-art-tenant/art-images Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Lightspeed redhat-user-workloads/crt-nshift-lightspeed-tenant/openshift-mcp-server Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-clients, redhat-user-workloads/ocp-serverless-tenant/serverless-operator-137/kn-plugin-event-sender Red Hat OpenShift Service Mesh 2 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/kiali-2-6 Red Hat OpenShift Service Mesh 3 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/kiali-3-0, redhat-user-workloads/service-mesh-tenant/kiali-3-1, redhat-user-workloads/service-mesh-tenant/kiali-3-2, redhat-user-workloads/service-mesh-tenant/kiali-3-3 Red Hat Power monitoring for Red Hat OpenShift redhat-user-workloads/rhpm-tenant/kepler Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/volsync-tenant/volsync-0-13, redhat-user-workloads/volsync-tenant/volsync-0-14, redhat-user-workloads/volsync-tenant/volsync-0-15 Red Hat Advanced Cluster Security 4 rhacs-eng/release-main Red Hat Ansible Automation Platform 2 receptor, automation-gateway-proxy, automation-gateway-proxy-openssl30, automation-gateway-proxy-openssl32, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/receptor-rhel9 Red Hat Ceph Storage 5 rhceph-ci/grafana Red Hat Ceph Storage 6 rhceph-ci/grafana Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Connectivity Link 1 redhat-user-workloads/api-management-tenant/rhcl-1-3-coredns Red Hat Developer Hub 1 rhdh/rhdh-rhel9-operator Red Hat Edge Manager 1 flightctl, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-api Red Hat Enterprise Linux 7 rhc, rhc-worker-script Red Hat Enterprise Linux 8 rhc, conmon, podman, skopeo, buildah, grafana, +31 more
27 more affected, 6 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
| go | stdlib | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
Affected products
- Go standard library html/template
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
go.dev
/cl/763762
patch
-
pkg.go.dev
/vuln/GO-2026-4865
vendor-advisory, advisory
-
go.dev
/issue/78331
issue-tracking, report
-
groups.google.com
/g/golang-announce/c/0uYbvbPZRWU
mailing-list, release-notes, discussion, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32289
web
Sources
- CVE List CVE-2026-32289
- NVD CVE-2026-32289
- OSV BIT-golang-2026-32289
- OSV GO-2026-4865
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.