CVE-2026-27142
Received Received - Intake
Cross-Site Scripting in Go HTML Meta Tag URL Handling

Publication date: 2026-03-06

Last updated on: 2026-04-21

Assigner: Go Project

Description
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-06
Last Modified
2026-04-21
Generated
2026-06-16
AI Q&A
2026-03-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27142
EUVD
EUVD-2026-10088
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
golang go to 1.25.8 (exc)
golang go 1.26.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs because actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs properly.

If the meta tag also has an http-equiv attribute with the value "refresh", this lack of escaping can allow cross-site scripting (XSS) attacks.

Additionally, a new GODEBUG setting named htmlmetacontenturlescape was introduced, which can disable escaping URLs in meta content attributes that follow "url=" by setting htmlmetacontenturlescape=0.

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks if an attacker is able to insert malicious URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute.

XSS attacks can allow attackers to execute arbitrary scripts in the context of the affected website, potentially leading to session hijacking, defacement, or redirection to malicious sites.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you can disable escaping URLs in actions in the meta content attribute by setting the GODEBUG environment variable htmlmetacontenturlescape=0.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart