CVE-2026-32289: Template Literal XSS Vulnerability

CVE-2026-32289 Overview

CVE-2026-32289 is a Cross-Site Scripting (XSS) vulnerability in the Go programming language's html/template package. The vulnerability stems from improper context tracking across template branches for JavaScript template literals, combined with incorrect brace depth tracking for template actions within JS template literals. These flaws can result in actions being incorrectly or improperly escaped, enabling XSS attacks against web applications built with Go.

Critical Impact

Web applications using Go's html/template package with JavaScript template literals may be vulnerable to XSS attacks due to improper escaping of user-controlled content in template branches.

Affected Products

• Go programming language html/template package
• Web applications using Go templates with JavaScript template literals
• Go-based web frameworks utilizing the affected template functionality

Discovery Timeline

• 2026-04-08 - CVE-2026-32289 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-32289

Vulnerability Analysis

The vulnerability exists in Go's html/template package, which is designed to automatically escape dynamic content to prevent injection attacks. However, two distinct issues were identified in how the package handles JavaScript template literals (backtick-delimited strings in JavaScript):

First, the template engine fails to properly track the escaping context when template branches (such as {{if}} and {{else}} blocks) are used within JS template literals. This means that content rendered in different branches may receive inconsistent or incorrect escaping treatment.

Second, the template engine does not correctly track brace depth (${...}) within JavaScript template literals. JavaScript template literals allow embedded expressions using ${} syntax, and the failure to properly track these nested structures results in the wrong escaping rules being applied to dynamic content.

Root Cause

The root cause is improper state management in the html/template parser when processing JavaScript template literals. The context-sensitive escaping mechanism loses track of the current parsing state when encountering branching logic or nested brace expressions within template literals. This architectural limitation means the escaping logic cannot accurately determine whether content should be treated as being inside or outside of a JavaScript expression context.

Attack Vector

An attacker can exploit this vulnerability by crafting input that, when processed through a vulnerable Go template containing JavaScript template literals with branches or nested expressions, results in malicious JavaScript code being rendered without proper escaping. This enables classic XSS attack scenarios where:

1. User-controlled data is passed to a Go template
2. The template renders this data within a JavaScript template literal context
3. Due to incorrect escaping, the attacker's payload executes in the victim's browser

The exploitation requires the target application to use html/template with JavaScript template literals that contain conditional branches or template actions, and to render user-controlled input within these constructs.

Detection Methods for CVE-2026-32289

Indicators of Compromise

• Unexpected JavaScript execution in web application responses
• User-reported suspicious behavior or redirects on affected pages
• Web application firewall alerts indicating XSS payload patterns in requests
• Anomalous client-side JavaScript errors logged by monitoring systems

Detection Strategies

• Review Go template files for usage of JavaScript template literals with conditional branches ({{if}}, {{else}}, {{range}})
• Audit templates that embed user-controlled data within backtick-delimited JavaScript strings
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Deploy web application firewall rules to detect common XSS payloads targeting template injection

Monitoring Recommendations

• Enable verbose logging for template rendering in development and staging environments
• Monitor for CSP violation reports that may indicate exploitation attempts
• Implement browser-side monitoring for unexpected script executions
• Review server logs for requests containing JavaScript-specific characters in unexpected parameters

How to Mitigate CVE-2026-32289

Immediate Actions Required

• Update Go to the latest patched version that addresses this vulnerability
• Audit all Go templates for usage of JavaScript template literals with branching logic
• Consider temporarily removing or refactoring templates that use JS template literals with conditional branches
• Implement strict Content Security Policy headers as a defense-in-depth measure

Patch Information

The Go team has addressed this vulnerability in a security update. The fix corrects the context tracking mechanism to properly handle template branches within JavaScript template literals and accurately track brace depth for embedded expressions. Administrators should review the Go.dev Change Log for patch details and the Go.dev Vulnerability Report for comprehensive vulnerability information. The official announcement is available via the Golang Announce Post.

Workarounds

• Avoid using JavaScript template literals (backticks) in Go templates where user input may be rendered
• Use traditional JavaScript string concatenation with explicit escaping functions instead of template literals
• Implement additional manual escaping for any user-controlled data rendered in JavaScript contexts
• Refactor templates to move dynamic JavaScript generation to server-side code with explicit sanitization

# Configuration example
# Verify your Go version and update to the patched release
go version

# Update Go to the latest patched version
# Download from https://go.dev/dl/ or use your package manager

# Rebuild your application with the updated Go version
go build -o myapp ./cmd/myapp

# Audit templates for affected patterns using grep
grep -r "{{.*}}" --include="*.html" --include="*.tmpl" . | grep -E "\`.*\$\{.*\}\`"