From d74da9314005954dd49fa20dabf272247bc76519 Mon Sep 17 00:00:00 2001
From: jamesread <contact@jread.com>
Date: Thu, 21 May 2026 23:51:17 +0100
Subject: [PATCH] security: GHSA-7fq5-7wr8-rjwj (HIGH) Shared template
 instances could cause command contamination

---
 service/internal/tpl/templates.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/service/internal/tpl/templates.go b/service/internal/tpl/templates.go
index cb9978f..e2e23d3 100644
--- a/service/internal/tpl/templates.go
+++ b/service/internal/tpl/templates.go
@@ -24,6 +24,8 @@ func jsonFunc(v any) (string, error) {
 	return string(data), nil
 }
 
+// Root template (funcs/options). parseTemplate clones before Parse — text/template
+// must not receive concurrent Parse calls on the same instance.
 var tpl = template.New("tpl").
 	Option("missingkey=error").
 	Funcs(template.FuncMap{"Json": jsonFunc})
@@ -179,7 +181,12 @@ func checkMissingArgumentError(err error) (bool, string) {
 }
 
 func parseTemplate(source string, data any) (string, error) {
-	t, err := tpl.Parse(source)
+	clone, err := tpl.Clone()
+	if err != nil {
+		return "", err
+	}
+
+	t, err := clone.Parse(source)
 
 	if err != nil {
 		return "", err