CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-testsUpgrade delveUpgrade golang-raceUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade go-toolset | Oct 11, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade rcloneUpgrade go | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade rclone-debuginfoUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade runcUpgrade cri-toolsUpgrade cri-tools-debuginfoUpgrade amazon-ecr-credential-helper-debuginfoUpgrade containerd-stressUpgrade golang-docsUpgrade oci-add-hooksUpgrade ecs-initUpgrade amazon-cloudwatch-agentUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade nerdctlUpgrade golang-sharedUpgrade nerdctl-debuginfoUpgrade golangUpgrade golist-debuginfoUpgrade golang-binUpgrade golang-miscUpgrade dockerUpgrade oci-add-hooks-debuginfoUpgrade golang-srcUpgrade soci-snapshotterUpgrade cni-plugins-debuginfoUpgrade golang-testsUpgrade rcloneUpgrade containerdUpgrade golistUpgrade containerd-debuginfoUpgrade runc-debuginfo | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade oci-add-hooks-debugsourceUpgrade yqUpgrade nerdctlUpgrade golangUpgrade oci-add-hooksUpgrade golist-debuginfoUpgrade golistUpgrade yq-debugsourceUpgrade credentials-fetcherUpgrade golang-binUpgrade golang-miscUpgrade rcloneUpgrade docker-debugsourceUpgrade runcUpgrade runc-debugsourceUpgrade runfinch-finchUpgrade golist-debugsourceUpgrade golang-srcUpgrade containerd-stress-debuginfoUpgrade ecs-initUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade rclone-debugsourceUpgrade containerd-stressUpgrade oci-add-hooks-debuginfoUpgrade amazon-ecr-credential-helperUpgrade yq-debuginfoUpgrade containerdUpgrade dockerUpgrade rclone-debuginfoUpgrade containerd-debugsourceUpgrade runc-debuginfoUpgrade docker-debuginfoUpgrade golang-docsUpgrade golang-tests | May 28, 2026 | May 7, 2026 |
| Freebsd | — | Upgrade gohugo | Jun 15, 2026 | May 29, 2026 |
| Oracle_linux | — | Upgrade delveUpgrade golang-raceUpgrade golang-docsUpgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade go-toolset | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade golang-testsUpgrade golang-raceNo solution existsUpgrade golang-docsUpgrade delveUpgrade delve-debugsourceUpgrade go-toolsetUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade delve-debuginfo | Jul 17, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade golang-raceUpgrade delve-debugsourceUpgrade delveUpgrade golang-binUpgrade delve-debuginfoUpgrade go-toolsetUpgrade golang | Aug 27, 2026 | Aug 26, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.15Upgrade Splunk Enterprise to version 10.0.10Upgrade Splunk Enterprise to version 10.4.3Upgrade Splunk Enterprise to version 10.2.7 | Oct 20, 2026 | May 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub