CVE-2026-27142
URLs in meta content attribute actions are not escaped in html/template
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
| Vendor | go standard library |
| Product | html/template |
| Published | Mar 6, 2026 |
| Last Updated | Mar 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library html/template
Be the first to know when new medium vulnerabilities affecting go standard library html/template are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / html/template
0 < 1.25.8 1.26.0-0 < 1.26.1