CVE-2026-39823 PUBLISHED

Bypass of meta content URL escaping causes XSS in html/template

Assigner: Go
Reserved: 07.04.2026 Published: 07.05.2026 Updated: 07.05.2026

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Product Status

Vendor Go standard library
Product html/template
Versions Default: unaffected
  • affected from 0 to 1.25.10 (excl.)
  • affected from 1.26.0-0 to 1.26.3 (excl.)

Credits

  • Samy Ghannad

References

Problem Types

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')