Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-39823

Bypass of meta content URL escaping causes XSS in html/template

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library html/template

Default version status: unaffected

  • 0 to < 1.25.10affected
  • 1.26.0-0 to < 1.26.3affected

References