This vulnerability in the Go standard library html/template package (CVE-2026-39823) involves improper neutralization of input during web page generation, specifically improper escaping of URLs in <meta> tag content attributes when ASCII whitespace surrounds the '=' character. This flaw enables partial bypass of escaping mechanisms, leading to a cross-site scripting (XSS) vulnerability. It affects Go versions from initial releases up to and including 1.26.0-0. There is no official remediation or patch available as of the published date, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to inject and execute arbitrary scripts in the context of a vulnerable application using the affected Go html/template package, potentially leading to information disclosure or user session compromise. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully review usage of the html/template package with respect to URL escaping in <meta> tags and consider applying manual input validation or escaping workarounds if feasible. Monitor official Go project communications for updates on patches or mitigations.