CVE-2026-27142

描述

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

如何修補 CVE-2026-27142

要修補 CVE-2026-27142,請將受影響套件升級到下列已修補版本。

• —升級至 1.25.8 或更新版本
• —未列出修補版本
• —未列出修補版本
• —未列出修補版本
• —升級至 1.25.8-1 或更新版本
• —升級至 1.26.1-1 或更新版本
• —升級至 1.25.8 或更新版本

CVE-2026-27142 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(7)

• from 0, < 1.25.8, >= 1.26.0-0, < 1.26.1
• from 0
• from 0
• from 0
• from 0, < 1.25.8-1
• from 0, < 1.26.1-1
• from 0, < 1.25.8, >= 1.26.0-0, < 1.26.1

CVSS 分數

參考連結(6)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-27142
• PATCHgo.dev/cl/752081
• REPORTgo.dev/issue/77954
• WEBgroups.google.com/g/golang-announce/c/EdhZqrQ98hk
• WEBnvd.nist.gov/vuln/detail/CVE-2026-27142