CVE-2026-71864: Unsafe Template Literal Quote Replacement
Naively replacing quotes with backticks without escaping backslashes, backticks, or interpolation expressions (${...}) allows template literal injection when generating code. Use a secure escaping library such as 'jsesc' with backtick options instead.
JSgreprules fetch cve-2026-71864-unsafe-template-literal-quote-replacement --engine opengrepDescription
Naively replacing quotes with backticks without escaping backslashes, backticks, or interpolation expressions (${...}) allows template literal injection when generating code. Use a secure escaping library such as 'jsesc' with backtick options instead.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.