Search: CVE-2026-27142

CVE-2026-27142 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs because URLs inserted into the content attribute of HTML meta tags are not properly escaped when the meta tag includes an http-equiv attribute with the value "refresh". This improper neutralization can allow an attacker to inject malicious scripts. A new GODEBUG setting, htmlmetacontenturlescape, has been introduced to control escaping behavior for URLs in meta content attributes. No official patch or fix details are provided in the available data.