CVE-2026-39823: Bypass of meta content URL escaping causes XSS in html/template

Q: What is the severity of CVE-2026-39823?

CVE-2026-39823 is considered a moderate severity vulnerability due to its potential for XSS exploitation.

Q: How do I fix CVE-2026-39823?

To fix CVE-2026-39823, ensure that URLs in the <meta> tag's <content> attribute are correctly escaped and avoid inserting ASCII whitespaces.

Published May 7, 2026

Updated

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Affected Software

3 affected components

go html/template

Golang Go<1.25.10

Golang Go>=1.26.0<1.26.3

Remediation

Patch Available

https://go.dev/cl/769920

Event History

May 7, 2026

CVE Published

via MITRE·07:41 PM

Data Sourced

via MITRE·07:41 PM

DescriptionWeakness

Data Sourced

via NVD·08:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-39823?

CVE-2026-39823 is considered a moderate severity vulnerability due to its potential for XSS exploitation.

How do I fix CVE-2026-39823?

To fix CVE-2026-39823, ensure that URLs in the <meta> tag's <content> attribute are correctly escaped and avoid inserting ASCII whitespaces.

What software is affected by CVE-2026-39823?

CVE-2026-39823 affects the Go html/template package.

What type of vulnerability is CVE-2026-39823?

CVE-2026-39823 is a Cross-Site Scripting (XSS) vulnerability caused by improper URL escaping in <meta> elements.

Can CVE-2026-39823 be exploited remotely?

Yes, CVE-2026-39823 can be exploited remotely if an attacker can control the content of the <meta> tag.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.