6.1
Medium
CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Description
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| html/template 1.26 | 1.26.0-0 → < 1.26.1 | 1.26.1 |
| html/template 1.25 | earliest → < 1.25.8 | 1.25.8 |
References
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of html/template
The 14 CVEs of html/template →
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset…
6.1
Medium
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would…
6.1
Medium
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject…
6.1
Medium
CVE-2026-39826
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an…
6.1
Medium