CVE-2026-27142

Published: Mar 06, 2026 Last Modified: Mar 16, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 6,1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: changed

Confidentiality: low

Integrity: low

Availability: none

Description

AI Translation Available

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value 'refresh'. A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow 'url=' by setting htmlmetacontenturlescape=0.