Cross-Site Scripting Vulnerability in Go Language's Meta Tag Handling
CVE-2026-39823

6.1MEDIUM

Key Information:

Vendor

Go Standard Library

Status
Html/template
Vendor
CVE Published:
7 May 2026

What is CVE-2026-39823?

A vulnerability exists in the Go Language's handling of URLs within the tag's attribute. When ASCII whitespace characters are improperly inserted around the '=' character, the escaping mechanism fails, which can enable the possibility of Cross-Site Scripting (XSS) attacks. This flaw could allow malicious users to inject executable scripts, compromising the security of web applications that utilize this functionality. It is crucial for developers to ensure proper escaping of URL content to mitigate these risks and enhance the security posture of their applications.

Affected Version(s)

html/template 0 < 1.25.10

html/template 1.26.0-0 < 1.26.3

References

https://go.dev/issue/78913
https://go.dev/cl/769920
https://groups.google.com/g/golang-announce/c/qcCIEXso47M

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Samy Ghannad
.