VDB
CVE-2026-94448
CVE-2026-94448
PUBLISHED
CVSS 6.1 MEDIUM
Reported by Go · Published October 8, 2026
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Risk Scores
CVSS 3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | html/template | 0, 1.27.0-0 |
| chainguard | git-credential-oauth | * |
| wolfi | trivy | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | chart-testing | * |
| chainguard | rancher-security-scan-fips-0.9 | * |
| chainguard | umoci | * |
| chainguard | kueue-fips-0.16 | 0 |
| chainguard | gitlab-cng-fips-19.2 | * |
| chainguard | opentofu-1.11 | 0 |
| chainguard | kube-mgmt-fips | * |
| chainguard | tempo-fips-3.0 | 0 |
| chainguard | keda-2.18 | * |
| chainguard | victoriatraces | * |
| wolfi | kratos | * |
| chainguard | go-fips-1.26 | * |
| chainguard | mcp-grafana-fips | 0 |
| chainguard | kbld-fips | * |
| wolfi | kubernetes-dashboard-metrics-scraper | * |
| chainguard | overmind | * |
…and 2398 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 14, 2026 EPSS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch
- Oct 28, 2026 Distribution Patch
- Oct 29, 2026 Distribution Patch
- Oct 29, 2026 Security Advisory