Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade go | Apr 13, 2026 | Apr 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade containerd-debuginfoUpgrade ecs-initUpgrade docker-debuginfoUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade golist-debuginfoUpgrade golang-docsUpgrade golistUpgrade amazon-ecr-credential-helperUpgrade oci-add-hooksUpgrade containerdUpgrade containerd-stressUpgrade runc-debuginfoUpgrade oci-add-hooks-debuginfoUpgrade runcUpgrade golang-srcUpgrade golang-miscUpgrade golangUpgrade runfinch-finchUpgrade dockerUpgrade nerdctl-debuginfoUpgrade soci-snapshotterUpgrade golang-binUpgrade amazon-ecr-credential-helper-debuginfoUpgrade golang-tests | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ecs-initUpgrade golist-debuginfoUpgrade amazon-cloudwatch-agentUpgrade credentials-fetcherUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-sharedUpgrade runc-debugsourceUpgrade golang-github-burntsushi-toml-debugsourceUpgrade docker-debugsourceUpgrade runcUpgrade rclone-debugsourceUpgrade oci-add-hooks-debuginfoUpgrade golangUpgrade golang-github-burntsushi-toml-develUpgrade docker-debuginfoUpgrade golang-github-burntsushi-toml-debuginfoUpgrade nerdctlUpgrade runfinch-finchUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade golang-github-burntsushi-tomlUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-github-burntsushi-toml-test-develUpgrade runc-debuginfoUpgrade amazon-ecr-credential-helperUpgrade golang-docsUpgrade containerd-stress-debuginfoUpgrade golang-srcUpgrade containerd-stressUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade containerd-debugsourceUpgrade oci-add-hooks-debugsourceUpgrade dockerUpgrade rclone-debuginfoUpgrade golang-testsUpgrade golang-binUpgrade oci-add-hooksUpgrade golang-miscUpgrade golistUpgrade golang-github-cpuguy83-md2manUpgrade containerdUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade golang-github-burntsushi-toml-testUpgrade golist-debugsourceUpgrade golang-github-cpuguy83-md2man-develUpgrade rclone | May 4, 2026 | Apr 8, 2026 |
| Redhat_linux | — | No solution existsUpgrade go-toolsetUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-raceUpgrade golang-binUpgrade golang-testsUpgrade golang-docs | Jul 17, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub