CVE-2026-27142

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Techniques & Countermeasures

• CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•addon-resizer

  < 0

• chainguard•addon-resizer-fips

  < 0

• chainguard•age

  < 0

• chainguard•agentbeat

  < 9.2.4-r5

• chainguard•agentbeat-fips

  < 9.2.4-r5

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 1.300064.1-r1

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard

  < 0

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips

  < 0

• chainguard•amazon-cloudwatch-agent-config-downloader

  < 0

• chainguard•amazon-cloudwatch-agent-config-downloader-fips

  < 0

• chainguard•amazon-cloudwatch-agent-config-translator

  < 0

• chainguard•amazon-cloudwatch-agent-config-translator-fips

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300064.1-r2

• chainguard•amazon-cloudwatch-agent-operator

  < 3.3.2-r1 | < 3.3.2-r0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.3.2-r2

• chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-ecs-agent

  < 1.102.0-r2

• chainguard•amazon-ecs-agent-fips

  < 1.102.0-r2 | < 1.102.0-r1

• chainguard•amazon-k8s-cni

  < 1.21.1-r5

• chainguard•amazon-k8s-cni-compat

  < 1.21.1-r5

• chainguard•amazon-k8s-cni-fips

  < 1.21.1-r6

• chainguard•amazon-k8s-cni-init

  < 1.21.1-r5 | < 0

• chainguard•amazon-k8s-cni-init-compat

  < 1.21.1-r5

• chainguard•amazon-k8s-cni-init-fips

  < 1.21.1-r6 | < 0

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.21.1-r6 | < 0

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 0

• chainguard•amazon-ssm-agent-fips

  < 0

• chainguard•apache-beam-java-11-sdk

  < 2.71.0-r3

• chainguard•apache-beam-java-17-sdk

  < 2.71.0-r3

• chainguard•apache-beam-java-21-sdk

  < 2.71.0-r3

• chainguard•apache-exporter

  < 1.0.12-r4

• chainguard•apisix-ingress-controller

  < 2.0.1-r5

• chainguard•apm-server-7.17

  < 7.17.29-r12

• chainguard•apm-server-8.17

  < 8.17.10-r8

• chainguard•apm-server-8.18

  < 8.18.8-r7

• chainguard•apm-server-8.19

  < 8.19.12-r3

• chainguard•apm-server-9.0

  < 9.0.8-r5

• chainguard•apm-server-9.1

  < 9.1.10-r3 | < 9.1.10-r4

• chainguard•apm-server-9.2

  < 9.2.6-r3

• chainguard•apm-server-9.3

  < 9.3.1-r3

• chainguard•apm-server-fips-7.17

  < 7.17.29-r12

• chainguard•apm-server-fips-8.17

  < 8.17.10-r7

• chainguard•apm-server-fips-8.18

  < 8.18.8-r7

• chainguard•apm-server-fips-8.19

  < 8.19.12-r3

• chainguard•apm-server-fips-9.0

  < 0

• chainguard•apm-server-fips-9.1

  < 0

Showing first 50 affected entries in server-rendered view.

References (14)

• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• https://go.dev/issue/77954
• https://go.dev/cl/752081
• https://pkg.go.dev/vuln/GO-2026-4603
• https://access.redhat.com/errata/RHSA-2026:5192
• https://access.redhat.com/security/cve/CVE-2026-27142
• https://access.redhat.com/security/updates/classification/
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5192.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2445351
• https://www.cve.org/CVERecord?id=CVE-2026-27142
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142
• https://security-tracker.debian.org/tracker/CVE-2026-27142
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27142.json