The vulnerability in Go's html/template package arises from improper escaping of URLs inserted into the content attribute of HTML meta tags that also have an http-equiv="refresh" attribute. This can lead to cross-site scripting (CWE-79) attacks. The issue affects Go versions up to 1.26.0-0. A new environment variable setting, htmlmetacontenturlescape, allows disabling escaping of URLs in these contexts, which may influence mitigation strategies. The CVSS 3.1 base score is 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application by injecting malicious content into meta refresh tags. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The new GODEBUG setting htmlmetacontenturlescape can be used to control escaping behavior, but its use may disable escaping and potentially increase risk if misconfigured. Users should monitor official Go project advisories for updates or patches addressing this vulnerability. Until a fix is available, carefully review and sanitize any user-controlled input that may be inserted into meta refresh content attributes.