CVE-2026-94448: Reset context tracking on consecutive template expressions in html/template
Reset context tracking on consecutive template expressions in html/template
Other sources
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.9-r0
Event History
Frequently Asked Questions
How can I identify templates that may be affected?
Review html/template output that includes JavaScript template literals with consecutive expressions and subsequent regular expression literals. Those constructs are the conditions described for incorrect context tracking and escaping.