CVE-2026-27142

Received Received - Intake

Cross-Site Scripting in Go HTML Meta Tag URL Handling

Publication date: 2026-03-06

Last updated on: 2026-04-21

Assigner: Go Project

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-06

Last Modified

2026-04-21

Generated

2026-07-07

AI Q&A

2026-03-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27142

EUVD

EUVD-2026-10088

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.8 (exc)
golang	go	1.26.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability occurs because actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs properly.

If the meta tag also has an http-equiv attribute with the value "refresh", this lack of escaping can allow cross-site scripting (XSS) attacks.

Additionally, a new GODEBUG setting named htmlmetacontenturlescape was introduced, which can disable escaping URLs in meta content attributes that follow "url=" by setting htmlmetacontenturlescape=0.

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks if an attacker is able to insert malicious URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute.

XSS attacks can allow attackers to execute arbitrary scripts in the context of the affected website, potentially leading to session hijacking, defacement, or redirection to malicious sites.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you can disable escaping URLs in actions in the meta content attribute by setting the GODEBUG environment variable htmlmetacontenturlescape=0.

Hi! I’m here to help you understand CVE-2026-27142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70