Summary
CVE-2026-32289: Go html/template XSS via incorrect JS template literal escaping (affects Tailscale/Chainguard).
Affected Asset
Tailscale — versions before 1.96.4-r1 (Chainguard and upstream).
Affected Endpoint
JS template literal rendering path (template actions within branches) in Tailscale web/admin interfaces.
Prerequisites
Tailscale instance using affected version; attacker can craft malicious template input through web/admin interface.
Steps to Reproduce
Craft input that exploits incorrect escaping across JS template branches, leading to XSS execution in the admin/user interface.
Evidence
Snyk / CVE advisory published 23 Apr 2026; CVSS 7.1 (High); affects Tailscale versions < 1.96.4-r1.
Impact
Cross-site scripting allows attacker to inject malicious scripts into the interface; potential session hijacking or admin action forgery.
Root Cause
JS template actions within branches did not properly track brace depth or context, causing incorrect escaping of content and enabling XSS.
Remediation
Upgrade Tailscale to version 1.96.4-r1 or higher (Chainguard package or upstream release).
Verification Steps
Confirm Tailscale version is >= 1.96.4-r1 (Chainguard / upstream) and that Go html/template is updated to >= 1.26.0.