CVE-2026-27142: URLs in meta content attribute actions are not escaped in html/template
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27142?
CVE-2026-27142 is classified as a moderate severity vulnerability due to the potential for XSS attacks.
How do I fix CVE-2026-27142?
To fix CVE-2026-27142, update to Golang Go version 1.26.0 or later, as earlier versions are affected.
What are the main risks associated with CVE-2026-27142?
The main risk associated with CVE-2026-27142 is that attackers could exploit the XSS vulnerability to execute malicious scripts in users' browsers.
Which versions of Golang are affected by CVE-2026-27142?
Golang Go versions prior to 1.26.0 and all versions below 1.25.8 are affected by CVE-2026-27142.
Is there a workaround for CVE-2026-27142?
Currently, there is no specific workaround for CVE-2026-27142 other than updating to a secure version of Golang.