CVE-2026-27142

Published: Mar 6, 2026

Modified: Mar 16, 2026

PUBLISHED

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Vendor	Product	Versions
Go standard library	html/template	affected `0 - < 1.25.8` affected `1.26.0-0 - < 1.26.1`

References

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk

https://go.dev/issue/77954

https://go.dev/cl/752081

https://pkg.go.dev/vuln/GO-2026-4603

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2026-27142

Description

Affected Products

References