CVE-2026-27142: URLs in meta content attribute actions are not escaped in html/template

Analyzed

AliasesRHSA-2026:5192UBUNTU-CVE-2026-27142DEBIAN-CVE-2026-27142+6821 more

Published 06-03-2026Last modified 16-03-2026

Vulnerability summary

CVE-2026-27142 is a medium (CVSS 6.1) vulnerability in go standard library html/template. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 31.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

06-03-2026
PublishedVulnerability first disclosed.
16-03-2026
Last modifiedVulnerability information updated.

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

CVSS metrics

8 scores · 8 sources · 1 version

v3.16.1

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.35% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)
addon-resizerAll versions (No fix recorded)
addon-resizer-fipsAll versions (No fix recorded)
ageAll versions (No fix recorded)

agentbeat< 9.2.4-r5
agentbeat-fips< 9.2.4-r5
amassAll versions (No fix recorded)
amazon-cloudwatch-agent< 1.300064.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizardAll versions (No fix recorded)
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloaderAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translatorAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300064.1-r2
amazon-cloudwatch-agent-operator< 3.3.2-r1 | < 3.3.2-r0
amazon-cloudwatch-agent-operator-fips< 3.3.2-r2
amazon-cloudwatch-agent-start-amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent< 1.102.0-r2
amazon-ecs-agent-fips< 1.102.0-r2 | < 1.102.0-r1
amazon-k8s-cni< 1.21.1-r5
amazon-k8s-cni-compat< 1.21.1-r5
amazon-k8s-cni-fips< 1.21.1-r6
amazon-k8s-cni-init< 1.21.1-r5 | All versions (No fix recorded)
amazon-k8s-cni-init-compat< 1.21.1-r5
amazon-k8s-cni-init-fips< 1.21.1-r6 | All versions (No fix recorded)
amazon-k8s-cni-init-fips-compat< 1.21.1-r6 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fipsAll versions (No fix recorded)
amazon-ssm-agent-fipsAll versions (No fix recorded)
apache-beam-java-11-sdk< 2.71.0-r3
apache-beam-java-17-sdk< 2.71.0-r3
apache-beam-java-21-sdk< 2.71.0-r3
apache-exporter< 1.0.12-r4
apisix-ingress-controller< 2.0.1-r5
apm-server-7.17< 7.17.29-r12
apm-server-8.17< 8.17.10-r8
apm-server-8.18< 8.18.8-r7
apm-server-8.19< 8.19.12-r3
apm-server-9.0< 9.0.8-r5
apm-server-9.1< 9.1.10-r3 | < 9.1.10-r4
apm-server-9.2< 9.2.6-r3
apm-server-9.3< 9.3.1-r3
apm-server-fips-7.17< 7.17.29-r12
apm-server-fips-8.17< 8.17.10-r7
apm-server-fips-8.18< 8.18.8-r7
apm-server-fips-8.19< 8.19.12-r3
apm-server-fips-9.0All versions (No fix recorded)
apm-server-fips-9.1All versions (No fix recorded)
apm-server-fips-9.2All versions (No fix recorded)
apm-server-fips-9.3All versions (No fix recorded)
argo-cd-2.14< 2.14.21-r10
argo-cd-2.14-compat< 2.14.21-r10
argo-cd-3.0< 3.0.23-r4
argo-cd-3.0-compat< 3.0.23-r4
argo-cd-3.1< 3.1.12-r6
argo-cd-3.2< 3.2.7-r2
argo-cd-3.2-compat< 3.2.7-r2
argo-cd-fips-2.14< 2.14.21-r9
argo-cd-fips-2.14-compat< 2.14.21-r9
argo-cd-fips-3.0< 3.0.23-r5
argo-cd-fips-3.0-compat< 3.0.23-r5
argo-cd-fips-3.1< 3.1.12-r5
argo-cd-fips-3.1-compat< 3.1.12-r5
argo-events< 1.9.10-r5
argo-events-fips< 1.9.10-r4
argo-rollouts< 1.8.4-r4
argo-rollouts-fips< 1.8.4-r5
argo-workflow-controller-fips-3.6< 3.6.19-r4
argo-workflow-controller-fips-3.7< 3.7.10-r5
argo-workflow-executor-fips-3.6< 3.6.19-r4
argo-workflow-executor-fips-3.7< 3.7.10-r5
argo-workflow-executor-fips-4.0< 4.0.1-r6
argo-workflows-fips-3.6< 3.6.19-r4
argo-workflows-fips-3.7< 3.7.10-r5
argocd-image-updater< 1.1.1-r3
argocd-image-updater-fips< 1.1.1-r4
atlantis< 0.40.0-r3
atlantis-fips< 0.40.0-r5
auditbeat-7< 7.17.29-r13
auditbeat-8.17< 8.17.10-r11
auditbeat-8.18< 8.18.8-r12
auditbeat-8.19< 8.19.12-r2
auditbeat-9.0< 9.0.8-r10
auditbeat-9.2< 9.2.6-r3
auditbeat-9.3< 9.3.1-r3
auditbeat-fips-7< 7.17.29-r13
auditbeat-fips-8.17< 8.17.10-r9
auditbeat-fips-8.18< 8.18.8-r10
auditbeat-fips-8.19< 8.19.12-r2
auditbeat-fips-9.0< 9.0.8-r9
auditbeat-fips-9.1< 9.1.10-r6
auditbeat-fips-9.2< 9.2.6-r2
auditbeat-fips-9.3All versions (No fix recorded)
authentik-go-server< 2026.2.1-r2
authservice< 1.1.5-r4
authservice-fips< 1.1.5-r5
aws-application-networking-k8sAll versions (No fix recorded)
aws-application-networking-k8s-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-1.49All versions (No fix recorded)
aws-ebs-csi-driver-1.50< 1.50.3-r6
aws-ebs-csi-driver-1.51< 1.51.2-r6
aws-ebs-csi-driver-1.52< 1.52.1-r7
aws-ebs-csi-driver-1.53< 1.53.0-r6
aws-ebs-csi-driver-1.54< 1.54.0-r6
aws-ebs-csi-driver-1.55< 1.55.0-r3
aws-ebs-csi-driver-1.56< 1.56.0-r3
aws-ebs-csi-driver-fips-1.49All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.50< 1.50.3-r6
aws-ebs-csi-driver-fips-1.51< 1.51.2-r6
aws-ebs-csi-driver-fips-1.52< 1.52.1-r6
aws-ebs-csi-driver-fips-1.53< 1.53.0-r6
aws-ebs-csi-driver-fips-1.54< 1.54.0-r5
aws-ebs-csi-driver-fips-1.55< 1.55.0-r4
aws-ebs-csi-driver-fips-1.56< 1.56.0-r3
aws-efs-csi-driver-fips< 2.3.0-r5
aws-eks-pod-identity-agentAll versions (No fix recorded)
aws-eks-pod-identity-agent-fipsAll versions (No fix recorded)
aws-flb-cloudwatch-fips< 1.9.4-r21
aws-flb-firehose-fips< 1.7.2-r20
aws-flb-kinesis< 1.10.3-r7
aws-flb-kinesis-fips< 1.10.3-r8
aws-fsx-csi-driver< 1.8.0-r4
aws-fsx-csi-driver-fips< 1.8.0-r4
aws-iam-authenticatorAll versions (No fix recorded)
aws-iam-authenticator-fipsAll versions (No fix recorded)
aws-load-balancer-controller< 3.1.0-r2
aws-load-balancer-controller-fipsAll versions (No fix recorded)
aws-network-policy-agent-fipsAll versions (No fix recorded)
aws-node-termination-handler-fips< 1.25.5-r1
aws-nukeAll versions (No fix recorded)
aws-nuke-fipsAll versions (No fix recorded)
aws-otel-collector< 0.47.0-r7
aws-otel-collector-fips< 0.47.0-r4
aws-otel-collector-healthcheckAll versions (No fix recorded)
aws-otel-collector-healthcheck-fipsAll versions (No fix recorded)
aws-privateca-issuerAll versions (No fix recorded)
aws-privateca-issuer-fipsAll versions (No fix recorded)
aws-s3-controllerAll versions (No fix recorded)
aws-signer-notation-pluginAll versions (No fix recorded)
aws-signer-notation-plugin-fipsAll versions (No fix recorded)
aws-sigv4-proxyAll versions (No fix recorded)
aws-sigv4-proxy-fipsAll versions (No fix recorded)
azcopy< 10.32.1-r7
azcopy-fips< 10.32.1-r3
azure-aad-pod-identity-mic< 1.8.17-r34
azure-aad-pod-identity-nmi< 1.8.17-r34
azure-ipamAll versions (No fix recorded)
azure-ipam-dropgzAll versions (No fix recorded)
azure-service-operator< 2.18.0-r4
azure-service-operator-fips< 2.18.0-r3
azure-vnet-cni< 1.7.12-r3
azure-workload-identity-webhookAll versions (No fix recorded)
azuredisk-csi-1.28< 1.28.12-r16
azuredisk-csi-1.29< 1.29.14-r15
azuredisk-csi-1.30< 1.30.12-r14
azuredisk-csi-1.31< 1.31.12-r10
azuredisk-csi-1.32< 1.32.12-r4
azuredisk-csi-1.33< 1.33.8-r5
azuredisk-csi-1.34< 1.34.2-r3
azuredisk-csi-fips-1.28< 1.28.12-r15
azuredisk-csi-fips-1.29< 1.29.14-r14
azuredisk-csi-fips-1.30< 1.30.12-r13
azuredisk-csi-fips-1.31< 1.31.12-r10
azuredisk-csi-fips-1.32< 1.32.12-r4
azuredisk-csi-fips-1.33< 1.33.8-r5
azuredisk-csi-fips-1.34< 1.34.2-r2
azurefile-csi-1.29All versions (No fix recorded)
azurefile-csi-1.30All versions (No fix recorded)
azurefile-csi-1.31< 1.31.8-r11
azurefile-csi-1.32< 1.32.9-r7
azurefile-csi-1.33< 1.33.8-r2
azurefile-csi-1.34< 1.34.4-r2
azurefile-csi-1.35< 1.35.1-r5
azurefile-csi-fips-1.29All versions (No fix recorded)
azurefile-csi-fips-1.30All versions (No fix recorded)
azurefile-csi-fips-1.31< 1.31.8-r12
azurefile-csi-fips-1.32< 1.32.9-r6
azurefile-csi-fips-1.33< 1.33.8-r2
azurefile-csi-fips-1.34< 1.34.4-r2
azurefile-csi-fips-1.35< 1.35.1-r2
backup-restore-operator-7.0< 7.0.5-r4
backup-restore-operator-8.1< 8.1.2-r3
backup-restore-operator-9.0< 9.0.1-r4
backup-restore-operator-fips-7.0< 7.0.5-r4
backup-restore-operator-fips-8.1< 8.1.2-r4
backup-restore-operator-fips-9.0< 9.0.1-r4
bank-vaults< 1.32.1-r6
bank-vaults-fips< 1.32.1-r2
bank-vaults-template< 1.32.1-r6
bank-vaults-template-fips< 1.32.1-r2
bento-fips< 1.15.1-r0
blob-csi-1.23< 1.23.11-r66
blob-csi-1.24< 1.24.11-r15
blob-csi-1.25< 1.25.10-r12
blob-csi-1.26< 1.26.10-r2
blob-csi-1.27< 1.27.3-r2

Show all 198

Alpine2 products

go< 1.25.8-r0
rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 3643

References

17 links

groups.google.com/g/golang-announce/c/EdhZqrQ98hkARTICLEREPORTWEBRelease Notes
go.dev/issue/77954ARTICLEREPORTWEBIssue Tracking
go.dev/cl/752081ARTICLEREPORTWEBFIXMailing List
pkg.go.dev/vuln/GO-2026-4603AdvisoryREPORTWEBVendor Advisory
access.redhat.com/errata/RHSA-2026:5192Advisory
access.redhat.com/security/cve/CVE-2026-27142REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5192.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2445351REPORT
www.cve.org/CVERecord?id=CVE-2026-27142AdvisoryREPORT

Show all 17 references

nvd.nist.gov/vuln/detail/CVE-2026-27142Advisory
ubuntu.com/security/CVE-2026-27142REPORT
github.com/golang/go/issues/77954REPORT
security-tracker.debian.org/tracker/CVE-2026-27142Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27142.jsonAdvisory
security.alpinelinux.org/vuln/CVE-2026-27142Advisory