Executive brief
A vulnerability exists in the Go programming language's standard library for handling HTML templates. If a developer uses these templates to generate web pages, an attacker could potentially inject malicious scripts into the page. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to fraudulent websites.
Technical details
A cross-site scripting (XSS) vulnerability exists in the Go 'html/template' package due to improper escaping of URLs within the 'content' attribute of HTML <meta> tags. The vulnerability occurs when URL content contains ASCII whitespace characters around the '=' character; the template escaper fails to correctly neutralize these sequences, allowing an attacker to break out of the attribute context. This is a bypass of a previous fix (CVE-2026-27142). Attackers can exploit this by providing specially crafted input to templates that use the 'Template.Execute' or 'Template.ExecuteTemplate' functions. The issue is resolved in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go < 1.25.10, >= 1.26.0 < 1.26.3
Timeline
- 2026-04-22: disclosed: Issue opened in Go project repository
- 2026-05-07: advisory: NVD and Go project published advisory
- 2026-05-07: patched: Fixes released in Go 1.25.10 and 1.26.3