CVE-2026-27142

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

How to fix CVE-2026-27142

To remediate CVE-2026-27142, upgrade the affected package to a fixed version below.

• —upgrade to 1.25.8 or later
• —no fix listed
• —no fix listed
• —no fix listed
• —upgrade to 1.25.8-1 or later
• —upgrade to 1.26.1-1 or later
• —upgrade to 1.25.8 or later

Is CVE-2026-27142 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 1.25.8, >= 1.26.0-0, < 1.26.1
• from 0
• from 0
• from 0
• from 0, < 1.25.8-1
• from 0, < 1.26.1-1
• from 0, < 1.25.8, >= 1.26.0-0, < 1.26.1

CVSS scores

References (6)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-27142
• PATCHgo.dev/cl/752081
• REPORTgo.dev/issue/77954
• WEBgroups.google.com/g/golang-announce/c/EdhZqrQ98hk
• WEBnvd.nist.gov/vuln/detail/CVE-2026-27142