CVE-2026-27142: 
Go vulnerability analysis and mitigation

CVE-2026-27142 is a Cross-Site Scripting (XSS) vulnerability in Go's html/template standard library package, where URLs inserted into the content attribute of HTML <meta> tags are not properly escaped. This flaw can be exploited when the meta tag also carries an http-equiv="refresh" attribute, allowing an attacker to inject malicious scripts that execute in a victim's browser. The vulnerability affects Go versions prior to 1.25.8 and version 1.26.0 (fixed in 1.26.1). It was published on March 6, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (pkg.go.dev, IBM Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79): Go's html/template package fails to escape URLs placed via template actions into the content attribute of <meta> tags when those tags include http-equiv="refresh". Specifically, template actions that follow url= in the content attribute are rendered without URL escaping, enabling injection of arbitrary JavaScript via crafted URLs. Exploitation requires no authentication but does require user interaction — a victim must load a page rendered by a vulnerable Go application that incorporates attacker-controlled data into such a meta tag. A new GODEBUG setting, htmlmetacontenturlescape, was introduced to control this behavior; setting htmlmetacontenturlescape=0 disables the new escaping (pkg.go.dev, golang-announce).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected web application. This can lead to session cookie theft, unauthorized actions performed on behalf of the user, redirection to malicious sites, or web content defacement. The scope is changed (attacker can affect resources beyond the vulnerable component), with low confidentiality and low integrity impact, and no direct availability impact (pkg.go.dev). Downstream IBM products including IBM Instana Observability, IBM App Connect Enterprise Certified Container, and IBM Db2 on Cloud Pak for Data are also affected due to their use of vulnerable Go versions (IBM Advisory, IBM ACE Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (pkg.go.dev). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target application: Find a Go web application using html/template (versions < 1.25.8 or == 1.26.0) that renders user-controlled or attacker-influenced data into the content attribute of an HTML <meta http-equiv="refresh"> tag.
2. Craft a malicious URL payload: Construct a URL value that, when inserted after url= in the meta content attribute, injects JavaScript — for example: 0; url=javascript:alert(document.cookie) or a URL that triggers a redirect to an attacker-controlled page.
3. Deliver the payload: Induce the application to render the malicious value in the meta tag, either by submitting it via a form, URL parameter, or any other input vector that feeds into the template action.
4. Trigger victim interaction: Lure a victim user to load the affected page (e.g., via phishing link or stored content).
5. Achieve script execution: When the victim's browser processes the <meta http-equiv="refresh" content="0; url=[payload]"> tag, the injected script executes in the browser context, enabling cookie theft, session hijacking, or further malicious actions (pkg.go.dev, golang-announce).

• Network: Unusual HTTP requests containing javascript: URI schemes or encoded XSS payloads in parameters that are reflected into HTML meta tags; unexpected outbound redirects from the application server to unknown domains.
• Logs: Web server access logs showing requests with URL-encoded or raw javascript: strings in query parameters or POST bodies; application error logs indicating unexpected template rendering behavior.
• Browser/Client-Side: Users reporting unexpected redirects, pop-ups, or session anomalies after visiting pages served by the affected Go application.
• Application Behavior: Presence of <meta http-equiv="refresh" content="...; url=javascript:..."> patterns in rendered HTML responses, detectable via web application firewall (WAF) or proxy inspection.

Upgrade Go to version 1.25.8 or later (for the 1.25.x branch) or 1.26.1 or later (for the 1.26.x branch) to receive the fix, which enables URL escaping in meta content attributes by default (pkg.go.dev). As a temporary workaround only (not recommended as it leaves the vulnerability active), set the environment variable GODEBUG=htmlmetacontenturlescape=0 to disable the new escaping behavior if compatibility issues arise. Additionally, implement Content Security Policy (CSP) headers to limit the impact of any XSS attacks, and validate/sanitize all user-supplied input rendered in HTML meta tags. IBM product users should apply the patches referenced in the respective IBM security bulletins (IBM Advisory, IBM ACE Advisory, IBM Db2 Advisory).

The Go team announced the fix via the golang-announce mailing list and published a detailed vulnerability entry in the Go vulnerability database (golang-announce, pkg.go.dev). The vulnerability was discussed on oss-sec and noted by the security community as a relatively narrow but real XSS risk in Go templating. Multiple Linux distributions (openSUSE, Amazon Linux) and downstream vendors (IBM, Portainer, Grafana, Splunk) issued advisories or updated their packages in response. Community reaction has been measured, with no significant controversy, reflecting the moderate severity and limited exploitation surface.