CVE-2026-39823

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (=) within a URL's content attribute inside a <meta> tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.

Red Hat products ship the Go html/template package as a dependency of various Go-based components. The affected functionality involves URL escaping inside <meta> tag content attributes, which requires an application to render user-controlled URLs in meta tags using html/template. While the vulnerable code is present, exploitation requires a specific usage pattern that is uncommon in Red Hat product code paths.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure that user-supplied URLs are validated and sanitized before being passed to Go's html/template package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.