CVE-2026-27142: URLs in meta content attribute actions are not escaped in html/template
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Other sources
URLs in meta content attribute actions are not escaped in html/template
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not set htmlmetacontenturlescape=0; keep htmlmetacontenturlescape enabled so URLs in the HTML meta tag content attribute actions following "url=" are escaped.
Go GODEBUG (htmlmetacontenturlescape) htmlmetacontenturlescape = 0 - Configuration
Ensure escaping is enabled for URLs inserted into the content attribute of HTML meta tags (actions following "url="), since URLs in meta content attribute actions are not escaped in html/template.
Go html/template URL escaping in meta content attribute actions (following "url=") = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27142?
CVE-2026-27142 is classified as a moderate severity vulnerability due to the potential for XSS attacks.
How do I fix CVE-2026-27142?
To fix CVE-2026-27142, update to Golang Go version 1.26.0 or later, as earlier versions are affected.
What are the main risks associated with CVE-2026-27142?
The main risk associated with CVE-2026-27142 is that attackers could exploit the XSS vulnerability to execute malicious scripts in users' browsers.
Which versions of Golang are affected by CVE-2026-27142?
Golang Go versions prior to 1.26.0 and all versions below 1.25.8 are affected by CVE-2026-27142.
Is there a workaround for CVE-2026-27142?
Currently, there is no specific workaround for CVE-2026-27142 other than updating to a secure version of Golang.