{"id":"EUVD-2026-20018","revision":"92e091607a04495e9c1653d389a28c90","records":[{"revision":"92e091607a04495e9c1653d389a28c90","observedAt":"2026-11-01T05:08:18.556+00:00","statement":{"source":"euvd","id":"EUVD-2026-20018","aliases":["CVE-2026-32289"],"title":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track …","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":null}],"references":["https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4865"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20018","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 8, 2026, 1:06:56 AM","dateUpdated":"Apr 13, 2026, 6:20:46 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-1006","title":"Golang Go: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"RHSA-2026:7291","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2025-22873","CVE-2025-47910","CVE-2025-47911","CVE-2025-47912","CVE-2025-47914","CVE-2025-58181","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-58190","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-61732","CVE-2025-68119","CVE-2025-68121","CVE-2026-25679","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33809","CVE-2026-33810"]},{"id":"SUSE-SU-2026:1320-1","title":"Security update for go1.26","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"openSUSE-SU-2026:10525-1","title":"go1.26-1.26.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"openSUSE-SU-2026:21319-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-61732","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27140","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42505","CVE-2026-42507"]},{"id":"RHSA-2026:19181","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2026-25679","CVE-2026-27137","CVE-2026-33810"]},{"id":"RHSA-2026:22112","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","vulnerabilityIds":["CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501"]},{"id":"openSUSE-SU-2026:20703-1","title":"Security update for coredns","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-32934","CVE-2026-32936","CVE-2026-33190","CVE-2026-33489","CVE-2026-33810","CVE-2026-35579"]},{"id":"SUSE-SU-2026:1580-1","title":"Security update for go1.26-openssl","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"openSUSE-SU-2026:20570-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"RHSA-2026:91249","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"RHSA-2026:10217","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"openSUSE-SU-2026:21254-1","title":"Security update for go1.26-openssl","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42507"]},{"id":"SUSE-SU-2026:21355-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"RHSA-2026:10219","title":"Red Hat Security Advisory: golang security update","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"openSUSE-SU-2026:20571-1","title":"Security update for go1.26","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"SUSE-SU-2026:21356-1","title":"Security update for go1.26","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810"]},{"id":"RHSA-2026:7385","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2025-22873","CVE-2025-47910","CVE-2025-47911","CVE-2025-47912","CVE-2025-47914","CVE-2025-58181","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-58190","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-61732","CVE-2025-68119","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27141","CVE-2026-27143","CVE-2026-27144","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33809","CVE-2026-33813","CVE-2026-42503"]},{"id":"openSUSE-SU-2026:10514-1","title":"go1.25-1.25.9-1.1 on GA media","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"SUSE-SU-2026:22638-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-61732","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27140","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42505","CVE-2026-42507"]},{"id":"SUSE-SU-2026:1321-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"RHSA-2026:91248","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-44172","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"SUSE-SU-2026:1581-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289"]},{"id":"msrc_CVE-2026-32289","title":"JsBraceDepth Context Tracking Bugs (XSS) in html/template","vulnerabilityIds":["CVE-2026-32289"]},{"id":"SUSE-SU-2026:22572-1","title":"Security update for go1.26-openssl","vulnerabilityIds":["CVE-2026-27140","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42507"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-20018","identifiers":["EUVD-2026-20018","CVE-2026-32289"]},"retained":false,"historicalAffected":[]}],"coverage":[]}