CLEANSTART-2026-SX24434: When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

Q: What conditions are required for exploitation?

The affected processing must encounter a JavaScript template literal containing consecutive expressions. The CVSS vector indicates exploitation is network-reachable, requires no privileges, and requires user interaction.

Q: What is the expected security impact?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The CVSS vector also indicates the issue can affect a scope beyond the initially vulnerable component.

Q: Which deployments should be prioritized for review?

Prioritize deployments that use cleanstart/trust-manager and process JavaScript template literals, particularly where consecutive expressions may occur. The provided information does not identify affected versions, default exposure, or a workaround.

Published Nov 13, 2026

Updated

Security vulnerability affects the trust-manager package. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.

Affected Software

1 affected componentFixes available

cleanstart/trust-manager<0.25.0-r1

0.25.0-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/trust-manager to a version that resolves this vulnerability.
Fixed in 0.25.0-r1

Event History

Nov 13, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94448

Frequently Asked Questions

What conditions are required for exploitation?

The affected processing must encounter a JavaScript template literal containing consecutive expressions. The CVSS vector indicates exploitation is network-reachable, requires no privileges, and requires user interaction.

What is the expected security impact?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The CVSS vector also indicates the issue can affect a scope beyond the initially vulnerable component.

Which deployments should be prioritized for review?

Prioritize deployments that use cleanstart/trust-manager and process JavaScript template literals, particularly where consecutive expressions may occur. The provided information does not identify affected versions, default exposure, or a workaround.

CLEANSTART-2026-SX24434: When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the expected security impact?

Which deployments should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the expected security impact?

Which deployments should be prioritized for review?