CVE-2026-39823Medium· 5.4▾ Sunlit

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)

A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper esc…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 29.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 7, 2026

Updated

Sep 21, 2026

CVSS

5.4

Vendor

Red Hat

Product

Red Hat OpenShift Container Platform 4

CWE

CWE-79

Depth score

30 · Low

EPSS

0.31% · p25

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 26.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

9 events · 137 days

May 7, 2026Published
Disclosed via CSAF
Aug 26, 2026EPSS first tracked
0.3%
Sep 8, 2026CVSS changed
— → 5.4
Sep 8, 2026Severity changed
none → medium
Sep 8, 2026CVSS changed
5.4 → —
Sep 8, 2026Severity changed
medium → none
Sep 8, 2026CVSS changed
— → 5.4
Sep 8, 2026Severity changed
none → medium
Sep 21, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-79 #csaf #vex #red-hat #osv #go

Affected

Patched in

enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_e4s_v_9_2
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
openshift_api_for_data_protection 1.6
hardened_images
openshift_distributed_tracing 3.10.2
multicluster_engine_for_kubernetes 2.11

Full technical detail▾

Overview

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (=) within a URL's content attribute inside a <meta> tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.

Vendor advisories

RHSA-2026:49702 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-03 · advisory
RHSA-2026:22120 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-01 · advisory
RHSA-2026:22112 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · advisory
RHSA-2026:61253 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · advisory
RHSA-2026:57649 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-20 · advisory
RHSA-2026:49712 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-03 · advisory
RHSA-2026:22121 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · advisory
RHSA-2026:43692 · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · advisory
RHSA-2026:23262 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:23264 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:50205 · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.10.2 · released 2026-08-04 · advisory
Red Hat VEX · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Red Hat Enterprise Linux 10, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, … · updated 2026-09-21 · vex

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-09-21.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
File Integrity Operator
Gatekeeper 3
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10

Fixed:

Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream E4S (v.9.2)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
OpenShift API for Data Protection 1.6
Red Hat Hardened Images
Red Hat OpenShift distributed tracing 3.10.2
multicluster engine for Kubernetes 2.11

No fix planned:

Red Hat Enterprise Linux 10
Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
File Integrity Operator
Gatekeeper 3
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Edge Manager 1

Not affected:

OpenShift API for Data Protection 1.6
Red Hat OpenShift distributed tracing 3.10.2
multicluster engine for Kubernetes 2.11
Red Hat OpenShift Container Platform 4

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:49702 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112

Workarounds / mitigations:

Ensure that user-supplied URLs are validated and sanitized before being passed to Go's html/template package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.

Package advisory (CVE-2026-39823)

Affected packages:

stdlib >= 1.26.0-0, < 1.26.3

Patched in:

stdlib 1.26.3

Source: https://osv.dev/vulnerability/GO-2026-4982

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS — → 5.4
Sep 8, 2026Severity none → medium
Sep 8, 2026CVSS 5.4 → —
Sep 8, 2026Severity medium → none
Sep 8, 2026CVSS — → 5.4
Sep 8, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed