CVE-2026-39823Medium· 5.4▾ SunlitA flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper esc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
— → 5.4
none → medium
5.4 → —
medium → none
— → 5.4
none → medium
Last analysed / modified upstream
0.3% → 0.3%
A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (=) within a URL's content attribute inside a <meta> tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.
html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:49702 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112
Workarounds / mitigations:
html/template package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.Affected packages:
stdlib >= 1.26.0-0, < 1.26.3Patched in:
stdlib 1.26.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39826Medium· 5.4html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)
CVE-2026-32289Medium· 5.4html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…
CVE-2026-39827Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings (CVE-2026-39827)
CVE-2026-39834Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
CVE-2026-39833Medium· 5.5golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)