Medium severity · published Mar 6, 2026
CVE-2026-27142
URLs in meta content attribute actions are not escaped in html/template
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
html/template · Go standard library
before 1.25.8; 1.26.0-0 before 1.26.1 · source: vendor
GO
GO · Golang
before 1.25.8; 1.26.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27142
Mailing List
https://go.dev/cl/752081
Issue Tracking
https://go.dev/issue/77954
Release Notes
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-4603
More from html/template
6.1
CVE-2026-97030
Recognize yield as regexp preceder keyword in html/template
6.1
CVE-2026-94448
Reset context tracking on consecutive template expressions in html/template
6.1
CVE-2026-56858
Fix Javascript regexp context tracking in html/template
6.1
CVE-2026-39823
Bypass of meta content URL escaping causes XSS in html/template
6.1
CVE-2026-39826
Escaper bypass leads to XSS in html/template