CVE-2026-39823

ADVISORY - golang

Summary

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

Common Weakness Enumeration (CWE)

Impacted images

Advisories

GoLang

CREATED

2 hours ago

UPDATED

2 hours ago

ADVISORY IDGO-2026-4982⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
stdlib	golang	-	-	>=1.26.0-0,<1.26.3	1.26.3
stdlib	golang	-	-	<1.25.10	1.25.10

Severity and metrics

No CVSS data available from this advisory.