When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
Details
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details.