Vulnerabilities CVE-2026-39823

CVE-2026-39823

Medium

Open

TLP:CLEAR

Bypass of meta content URL escaping causes XSS in html/template

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Details

CVSS Score: 6.1
EPSS Score ⓘ: 0.31%

24.2th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Confidence: 90%
Published: May 7, 2026
Last Modified: May 8, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.