Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
html/template may allow JavaScript injection
published 6 months ago
Summary
The Go html/template feature that builds web pages can mishandle certain JavaScript sections, especially when using conditional code or embedded expressions. This can cause the system to fail to properly clean user-supplied data, opening the door for malicious scripts to run in a visitor's browser. Update to the latest version of Go or apply the provided patches to ensure all JavaScript content is correctly escaped.
What to do
- Update bellsoft go to version 1.25.9-r0.
- Update bellsoft go to version 1.26.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpaquita:23 | bellsoft | go |
>= 1.19.7-r0, < 1.25.9-r0 Fix: upgrade to 1.25.9-r0
|
| Alpaquita:25 | bellsoft | go |
>= 1.24.3-r0, < 1.25.9-r0 Fix: upgrade to 1.25.9-r0
|
| Alpaquita:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.2-r0 Fix: upgrade to 1.26.2-r0
|
| BellSoft Hardened Containers:25 | bellsoft | go |
>= 1.24.3-r0, < 1.25.9-r0 Fix: upgrade to 1.25.9-r0
|
| BellSoft Hardened Containers:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.2-r0 Fix: upgrade to 1.26.2-r0
|
| BellSoft Hardened Containers:23 | bellsoft | go |
>= 1.19.7-r0, < 1.25.9-r0 Fix: upgrade to 1.25.9-r0
|
Original advisory text
BELL-CVE-2026-32289
References
- https://docs.bell-sw.com/security/cves/CVE-2026-32289 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published9 Apr 2026
Updated15 Apr 2026
First seen15 Apr 2026
Track software like this
Free during beta