# CVE-2026-32289: JsBraceDepth Context Tracking Bugs (XSS) in html/template CVE-2026-32289 is fixed in 57 products on 2 platforms, first by Go Programming Language 1.26.2, released April 7, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-32289 - Priority: Routine - CVSS: 6.1 (Moderate) - EPSS: 0.0030 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 8, 2026 - Weakness: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32289 ## Description Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Windows apps | Go Programming Language | 1.26.2 | [Go Programming Language 1.26.2](https://patchblox.com/security/data/fix/windows-app/golang.go-1.26.2.md) | Apr 7, 2026 | | Linux | amazon-cloudwatch-agent amzn 2023 | 1.300066.2-2.amzn2023 | [ALAS2023-2026-1747](https://patchblox.com/security/data/fix/linux/alas2023-2026-1747.md) | May 25, 2026 | | Linux | amazon-ecr-credential-helper amzn 2023 | 0.12.0-2.amzn2023 | [ALAS2023-2026-1645](https://patchblox.com/security/data/fix/linux/alas2023-2026-1645.md) | May 11, 2026 | | Linux | compat-golang-github-cpuguy83-md2man-2-devel amzn 2023 | 2.0.2-24.amzn2023.0.7 | [ALAS2023-2026-1749](https://patchblox.com/security/data/fix/linux/alas2023-2026-1749.md) | May 25, 2026 | | Linux | containerd amzn 2023 | 2.2.3-1.amzn2023.0.1 | [ALAS2023-2026-1606](https://patchblox.com/security/data/fix/linux/alas2023-2026-1606.md) | Apr 27, 2026 | | Linux | containerd-debuginfo amzn 2023 | 2.2.3-1.amzn2023.0.1 | [ALAS2023-2026-1606](https://patchblox.com/security/data/fix/linux/alas2023-2026-1606.md) | Apr 27, 2026 | | Linux | containerd-debugsource amzn 2023 | 2.2.3-1.amzn2023.0.1 | [ALAS2023-2026-1606](https://patchblox.com/security/data/fix/linux/alas2023-2026-1606.md) | Apr 27, 2026 | | Linux | containerd-stress amzn 2023 | 2.2.3-1.amzn2023.0.1 | [ALAS2023-2026-1606](https://patchblox.com/security/data/fix/linux/alas2023-2026-1606.md) | Apr 27, 2026 | | Linux | containerd-stress-debuginfo amzn 2023 | 2.2.3-1.amzn2023.0.1 | [ALAS2023-2026-1606](https://patchblox.com/security/data/fix/linux/alas2023-2026-1606.md) | Apr 27, 2026 | | Linux | credentials-fetcher amzn 2023 | 2.0.1-1.amzn2023.0.3 | [ALAS2023-2026-1598](https://patchblox.com/security/data/fix/linux/alas2023-2026-1598.md) | Apr 27, 2026 | | Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | docker amzn 2023 | 25.0.14-1.amzn2023.0.4 | [ALAS2023-2026-1615](https://patchblox.com/security/data/fix/linux/alas2023-2026-1615.md) | Apr 27, 2026 | | Linux | docker-debuginfo amzn 2023 | 25.0.14-1.amzn2023.0.4 | [ALAS2023-2026-1615](https://patchblox.com/security/data/fix/linux/alas2023-2026-1615.md) | Apr 27, 2026 | | Linux | docker-debugsource amzn 2023 | 25.0.14-1.amzn2023.0.4 | [ALAS2023-2026-1615](https://patchblox.com/security/data/fix/linux/alas2023-2026-1615.md) | Apr 27, 2026 | | Linux | ecs-init amzn 2023 | 1.103.0-1.amzn2023 | [ALAS2023-2026-1637](https://patchblox.com/security/data/fix/linux/alas2023-2026-1637.md) | Apr 27, 2026 | | Linux | go-toolset RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | go-toolset RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | go-toolset almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | go1.25 opensuse-leap 16.0 | 1.25.9-160000.1.1 | [OPENSUSE-SU-2026:20570-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20570-1.md) | Apr 20, 2026 | | Linux | go1.25 sles 15.6 | 1.25.9-150000.1.35.1 | [SUSE-SU-2026:1321-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1321-1.md) | Apr 14, 2026 | | Linux | go1.25 sles 15.7 | 1.25.9-150000.1.35.1 | [SUSE-SU-2026:1321-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1321-1.md) | Apr 14, 2026 | | Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.12-160000.1.1 | [OPENSUSE-SU-2026:21319-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21319-1.md) | Jul 13, 2026 | | Linux | go1.25-openssl sles 16.0 | 1.25.12-160000.1.1 | [SUSE-SU-2026:22638-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22638-1.md) | Jul 13, 2026 | | Linux | go1.26 opensuse-leap 16.0 | 1.26.2-160000.1.1 | [OPENSUSE-SU-2026:20571-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20571-1.md) | Apr 20, 2026 | | Linux | go1.26 sles 15.6 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 | | Linux | go1.26 sles 15.7 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 | | Linux | go1.26-openssl opensuse-leap 16.0 | 1.26.4-160000.1.1 | [OPENSUSE-SU-2026:21254-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21254-1.md) | Jul 7, 2026 | | Linux | go1.26-openssl sles 16.0 | 1.26.4-160000.1.1 | [SUSE-SU-2026:22572-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22572-1.md) | Jul 7, 2026 | | Linux | golang RHEL 10 | 1.25.9-3.el10_1 | [RHSA-2026:10217](https://patchblox.com/security/data/fix/linux/rhsa-2026-10217.md) | Apr 8, 2026 | | Linux | golang RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-1.26 Debian 14 | 1.26.2-1 | [DEBIAN-CVE-2026-32289](https://patchblox.com/security/data/fix/linux/debian-cve-2026-32289.md) | Apr 8, 2026 | | Linux | golang-bin RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-bin RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-bin almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-bin amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-docs RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-docs RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-docs almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-docs amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-github-burntsushi-toml amzn 2023 | 1.5.0-1.amzn2023.0.1 | [ALAS2023-2026-1751](https://patchblox.com/security/data/fix/linux/alas2023-2026-1751.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-debuginfo amzn 2023 | 1.5.0-1.amzn2023.0.1 | [ALAS2023-2026-1751](https://patchblox.com/security/data/fix/linux/alas2023-2026-1751.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-debugsource amzn 2023 | 1.5.0-1.amzn2023.0.1 | [ALAS2023-2026-1751](https://patchblox.com/security/data/fix/linux/alas2023-2026-1751.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-devel amzn 2023 | 1.5.0-1.amzn2023.0.1 | [ALAS2023-2026-1751](https://patchblox.com/security/data/fix/linux/alas2023-2026-1751.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-test amzn 2023 | 0.2.0-8.amzn2023.0.3 | [ALAS2023-2026-1750](https://patchblox.com/security/data/fix/linux/alas2023-2026-1750.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-test-debuginfo amzn 2023 | 0.2.0-8.amzn2023.0.3 | [ALAS2023-2026-1750](https://patchblox.com/security/data/fix/linux/alas2023-2026-1750.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-test-debugsource amzn 2023 | 0.2.0-8.amzn2023.0.3 | [ALAS2023-2026-1750](https://patchblox.com/security/data/fix/linux/alas2023-2026-1750.md) | May 25, 2026 | | Linux | golang-github-burntsushi-toml-test-devel amzn 2023 | 0.2.0-8.amzn2023.0.3 | [ALAS2023-2026-1750](https://patchblox.com/security/data/fix/linux/alas2023-2026-1750.md) | May 25, 2026 | | Linux | golang-github-cpuguy83-md2man amzn 2023 | 2.0.2-24.amzn2023.0.7 | [ALAS2023-2026-1749](https://patchblox.com/security/data/fix/linux/alas2023-2026-1749.md) | May 25, 2026 | | Linux | golang-github-cpuguy83-md2man-debuginfo amzn 2023 | 2.0.2-24.amzn2023.0.7 | [ALAS2023-2026-1749](https://patchblox.com/security/data/fix/linux/alas2023-2026-1749.md) | May 25, 2026 | | Linux | golang-github-cpuguy83-md2man-debugsource amzn 2023 | 2.0.2-24.amzn2023.0.7 | [ALAS2023-2026-1749](https://patchblox.com/security/data/fix/linux/alas2023-2026-1749.md) | May 25, 2026 | | Linux | golang-github-cpuguy83-md2man-devel amzn 2023 | 2.0.2-24.amzn2023.0.7 | [ALAS2023-2026-1749](https://patchblox.com/security/data/fix/linux/alas2023-2026-1749.md) | May 25, 2026 | | Linux | golang-misc RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-misc RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-misc almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-misc amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-race RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-race RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-race almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-shared amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-src RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-src RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-src almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-src amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golang-tests RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-tests RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 | | Linux | golang-tests almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 | | Linux | golang-tests amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 | | Linux | golist amzn 2023 | 0.10.4-12.amzn2023.0.8 | [ALAS2023-2026-1599](https://patchblox.com/security/data/fix/linux/alas2023-2026-1599.md) | Apr 27, 2026 | | Linux | golist-debuginfo amzn 2023 | 0.10.4-12.amzn2023.0.8 | [ALAS2023-2026-1599](https://patchblox.com/security/data/fix/linux/alas2023-2026-1599.md) | Apr 27, 2026 | | Linux | golist-debugsource amzn 2023 | 0.10.4-12.amzn2023.0.8 | [ALAS2023-2026-1599](https://patchblox.com/security/data/fix/linux/alas2023-2026-1599.md) | Apr 27, 2026 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 | | Linux | nerdctl amzn 2023 | 2.2.2-1.amzn2023.0.1 | [ALAS2023-2026-1605](https://patchblox.com/security/data/fix/linux/alas2023-2026-1605.md) | Apr 27, 2026 | | Linux | oci-add-hooks amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.10 | [ALAS2023-2026-1660](https://patchblox.com/security/data/fix/linux/alas2023-2026-1660.md) | May 11, 2026 | | Linux | oci-add-hooks-debuginfo amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.10 | [ALAS2023-2026-1660](https://patchblox.com/security/data/fix/linux/alas2023-2026-1660.md) | May 11, 2026 | | Linux | oci-add-hooks-debugsource amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.10 | [ALAS2023-2026-1660](https://patchblox.com/security/data/fix/linux/alas2023-2026-1660.md) | May 11, 2026 | | Linux | rclone amzn 2023 | 1.73.4-74.amzn2023 | [ALAS2023-2026-1607](https://patchblox.com/security/data/fix/linux/alas2023-2026-1607.md) | Apr 27, 2026 | | Linux | rclone-debuginfo amzn 2023 | 1.73.4-74.amzn2023 | [ALAS2023-2026-1607](https://patchblox.com/security/data/fix/linux/alas2023-2026-1607.md) | Apr 27, 2026 | | Linux | rclone-debugsource amzn 2023 | 1.73.4-74.amzn2023 | [ALAS2023-2026-1607](https://patchblox.com/security/data/fix/linux/alas2023-2026-1607.md) | Apr 27, 2026 | | Linux | runc amzn 2023 | 1.3.4-4.amzn2023.0.2 | [ALAS2023-2026-1661](https://patchblox.com/security/data/fix/linux/alas2023-2026-1661.md) | May 11, 2026 | | Linux | runc-debuginfo amzn 2023 | 1.3.4-4.amzn2023.0.2 | [ALAS2023-2026-1661](https://patchblox.com/security/data/fix/linux/alas2023-2026-1661.md) | May 11, 2026 | | Linux | runc-debugsource amzn 2023 | 1.3.4-4.amzn2023.0.2 | [ALAS2023-2026-1661](https://patchblox.com/security/data/fix/linux/alas2023-2026-1661.md) | May 11, 2026 | | Linux | runfinch-finch amzn 2023 | 1.17.0-1.amzn2023.0.1 | [ALAS2023-2026-1671](https://patchblox.com/security/data/fix/linux/alas2023-2026-1671.md) | May 11, 2026 | | Linux | soci-snapshotter amzn 2023 | 0.13.0-1.amzn2023.0.2 | [ALAS2023-2026-1700](https://patchblox.com/security/data/fix/linux/alas2023-2026-1700.md) | May 11, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.