CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Go Standard Library |
|
No data.
No data.
References
History
Fri, 08 May 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Fri, 08 May 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Fri, 08 May 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 07 May 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library html/template |
|
| Vendors & Products |
Go Standard Library
Go Standard Library html/template |
Thu, 07 May 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Thu, 07 May 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. | |
| Title | Bypass of meta content URL escaping causes XSS in html/template | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Go
Published: 2026-05-07T19:41:19.524Z
Updated: 2026-05-08T14:05:55.152Z
Reserved: 2026-04-07T18:13:03.527Z
Link: CVE-2026-39823
Vulnrichment
Updated: 2026-05-08T14:05:50.846Z
NVD
Status : Undergoing Analysis
Published: 2026-05-07T20:16:43.290
Modified: 2026-05-08T15:16:37.500
Link: CVE-2026-39823
Redhat
No data.