CVE-2026-94448 — Reset context tracking on consecutive template expressions in html/template
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that templat…
Published: 2026-10-08 · CVSS: 6.1 · CVSS 3.1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7