UNKNOWN Go
Reset context tracking on consecutive template expressions in html/template
GO-2026-6599 · BIT-golang-2026-94448 · CVE-2026-94448
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes