Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade go | Apr 13, 2026 | Apr 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade containerdUpgrade runc-debuginfoUpgrade golist-debuginfoUpgrade oci-add-hooksUpgrade golang-docsUpgrade containerd-stressUpgrade docker-debuginfoUpgrade amazon-ecr-credential-helperUpgrade nerdctlUpgrade golistUpgrade amazon-cloudwatch-agentUpgrade oci-add-hooks-debuginfoUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade ecs-initUpgrade golang-testsUpgrade golangUpgrade soci-snapshotterUpgrade runcUpgrade golang-binUpgrade golang-miscUpgrade golang-srcUpgrade runfinch-finchUpgrade nerdctl-debuginfoUpgrade dockerUpgrade amazon-ecr-credential-helper-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade docker-debugsourceUpgrade golang-sharedUpgrade oci-add-hooks-debuginfoUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-github-burntsushi-tomlUpgrade ecs-initUpgrade golang-github-burntsushi-toml-debugsourceUpgrade credentials-fetcherUpgrade golist-debuginfoUpgrade amazon-cloudwatch-agentUpgrade runcUpgrade rclone-debugsourceUpgrade runfinch-finchUpgrade docker-debuginfoUpgrade golang-github-burntsushi-toml-test-develUpgrade golang-github-burntsushi-toml-develUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade golang-github-burntsushi-toml-debuginfoUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade containerd-stressUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade nerdctlUpgrade golangUpgrade golang-docsUpgrade amazon-ecr-credential-helperUpgrade golang-srcUpgrade containerd-stress-debuginfoUpgrade rcloneUpgrade golang-github-cpuguy83-md2man-develUpgrade containerdUpgrade containerd-debugsourceUpgrade golistUpgrade golang-miscUpgrade rclone-debuginfoUpgrade oci-add-hooks-debugsourceUpgrade dockerUpgrade soci-snapshotterUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade golang-github-burntsushi-toml-testUpgrade containerd-debuginfoUpgrade golang-binUpgrade oci-add-hooksUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2manUpgrade golist-debugsource | May 4, 2026 | Apr 8, 2026 |
| Redhat_linux | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-raceUpgrade golang-testsUpgrade golang-srcUpgrade go-toolsetUpgrade golangNo solution existsUpgrade golang-misc | Jul 17, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub