Search: CVE-2026-39823

CVE-2026-39823 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises from improper escaping of URLs within a <meta> tag's content attribute when ASCII whitespaces surround the '=' character, which allows partial bypass of escaping. This affects Go versions up to 1.26.0-0. No official patch or remediation guidance has been confirmed by the vendor, and no known exploits exist in the wild at this time.