An input escaping flaw exists in the golang html/template module where URLs inserted into the content attribute of HTML meta tags are not properly escaped if the meta tag also has an http-equiv attribute with the value "refresh". This can enable cross-site scripting (CWE-79) attacks. Red Hat Hardened Images RPMs are affected. A new GODEBUG setting (htmlmetacontenturlescape) allows disabling escaping of URLs in meta content attributes, but this is not considered a sufficient mitigation by Red Hat. No patches or fixes have been released as of the advisory date. The vulnerability could allow execution of unauthorized code or disclosure of sensitive information via XSS, but no known exploits are reported in the wild.

The vulnerability enables cross-site scripting attacks by failing to escape URLs in meta refresh tags, potentially allowing attackers to execute unauthorized scripts in the context of affected web applications. This can lead to disclosure of sensitive information such as cookies or session data, and possibly unauthorized actions performed on behalf of users. The impact is rated medium by Red Hat. No active exploitation has been reported.

No official fix or patch is currently available for this vulnerability. Red Hat states that existing mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. The GODEBUG environment variable htmlmetacontenturlescape can be set to 0 to disable URL escaping in meta content attributes, but this is not recommended as a reliable mitigation. No additional vendor-recommended mitigations are provided at this time.