JsBraceDepth Context Tracking Bugs (XSS) in html/template

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-32289 · Microsoft / collected KEV context

EUVD-2026-20018

GO-2026-4865

BIT-golang-2026-32289

cve-program · CVE-2026-32289

• https://go.dev/cl/763762
• https://go.dev/issue/78331
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• https://pkg.go.dev/vuln/GO-2026-4865

euvd · EUVD-2026-20018

• https://go.dev/cl/763762
• https://go.dev/issue/78331
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• https://pkg.go.dev/vuln/GO-2026-4865

nvd · CVE-2026-32289

• https://go.dev/cl/763762
• https://go.dev/issue/78331
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• https://pkg.go.dev/vuln/GO-2026-4865

osv · GO-2026-4865

• https://go.dev/cl/763762
• https://go.dev/issue/78331
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

• Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track … · Advisory content revised · 1 Nov 2026
• Release 2026-05-29 · Tool release · 4 Jun 2026