REDHAT-BUG-2467811: XSS

Published May 7, 2026

Updated

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Affected Software

1 affected component

Red Hat Red Hat Enterprise Linux

Event History

May 7, 2026

Data Sourced

via Red Hat·08:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

An attacker would need to influence URL content placed in a meta tag's content attribute and craft it with ASCII whitespace around an equals sign. Under those conditions, the URL escaper may fail to escape the value correctly, enabling XSS.

Which Red Hat advisories cover the fix?

Red Hat references RHSA-2026:22120 and RHSA-2026:22121 for this issue. The associated CVE is CVE-2026-27142.

REDHAT-BUG-2467811: XSS

Affected Software

Event History

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

Which Red Hat advisories cover the fix?

Company

Resources

Contact

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

Which Red Hat advisories cover the fix?