Junglewise Threat Intelligence

CVE-2026-39823: Go html/template XSS via improper escaping in meta tags

CVE-2026-39823 · Severity: medium · CVSS 6.1 · Published 2026-05-07

Technologies: stdlib (Go). Vendors: Go, Google.

Executive brief

A vulnerability exists in the Go programming language's standard library for handling HTML templates. If a developer uses these templates to generate web pages, an attacker could potentially inject malicious scripts into the page. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to fraudulent websites.

Technical details

A cross-site scripting (XSS) vulnerability exists in the Go 'html/template' package due to improper escaping of URLs within the 'content' attribute of HTML <meta> tags. The vulnerability occurs when URL content contains ASCII whitespace characters around the '=' character; the template escaper fails to correctly neutralize these sequences, allowing an attacker to break out of the attribute context. This is a bypass of a previous fix (CVE-2026-27142). Attackers can exploit this by providing specially crafted input to templates that use the 'Template.Execute' or 'Template.ExecuteTemplate' functions. The issue is resolved in Go versions 1.25.10 and 1.26.3.

Affected products

  • Google Go < 1.25.10, >= 1.26.0 < 1.26.3

Timeline

  • 2026-04-22: disclosed: Issue opened in Go project repository
  • 2026-05-07: advisory: NVD and Go project published advisory
  • 2026-05-07: patched: Fixes released in Go 1.25.10 and 1.26.3

References

Related threats