Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade go | Mar 9, 2026 | Mar 6, 2026 |
| Amazon Linux Ami 2 | — | Upgrade cni-pluginsUpgrade golangUpgrade golang-srcUpgrade containerd-stressUpgrade nerdctl-debuginfoUpgrade dockerUpgrade golang-docsUpgrade ecs-initUpgrade golang-testsUpgrade runc-debuginfoUpgrade golang-binUpgrade runcUpgrade nerdctlUpgrade containerdUpgrade oci-add-hooksUpgrade docker-debuginfoUpgrade rclone-debuginfoUpgrade rcloneUpgrade containerd-debuginfoUpgrade cri-tools-debuginfoUpgrade runfinch-finchUpgrade cri-toolsUpgrade golang-miscUpgrade golistUpgrade amazon-ecr-credential-helper-debuginfoUpgrade soci-snapshotterUpgrade oci-add-hooks-debuginfoUpgrade cni-plugins-debuginfoUpgrade golist-debuginfoUpgrade amazon-cloudwatch-agentUpgrade amazon-ecr-credential-helperUpgrade golang-shared | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-debuginfoUpgrade golang-miscUpgrade rclone-debuginfoUpgrade golistUpgrade golist-debugsourceUpgrade golang-github-burntsushi-toml-testUpgrade oci-add-hooksUpgrade dockerUpgrade rclone-debugsourceUpgrade golang-github-burntsushi-toml-debugsourceUpgrade libcap-staticUpgrade oci-add-hooks-debugsourceUpgrade golang-testsUpgrade containerdUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade soci-snapshotterUpgrade containerd-debugsourceUpgrade golang-binUpgrade captreeUpgrade golang-github-burntsushi-toml-develUpgrade libcap-develUpgrade git-lfs-debugsourceUpgrade golang-github-cpuguy83-md2manUpgrade rcloneUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-develUpgrade golist-debuginfoUpgrade libcap-debugsourceUpgrade ecs-initUpgrade oci-add-hooks-debuginfoUpgrade git-lfsUpgrade cni-plugins-debugsourceUpgrade containerd-stressUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade git-lfs-debuginfoUpgrade yqUpgrade runcUpgrade runfinch-finchUpgrade yq-debuginfoUpgrade libcap-debuginfoUpgrade golang-github-burntsushi-toml-test-develUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade golangUpgrade credentials-fetcherUpgrade containerd-stress-debuginfoUpgrade cni-pluginsUpgrade cni-plugins-debuginfoUpgrade golang-sharedUpgrade golang-github-burntsushi-toml-debuginfoUpgrade amazon-cloudwatch-agentUpgrade captree-debuginfoUpgrade nerdctlUpgrade amazon-ecr-credential-helperUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-srcUpgrade golang-github-burntsushi-tomlUpgrade golang-docsUpgrade docker-debugsourceUpgrade runc-debugsourceUpgrade libcapUpgrade docker-debuginfoUpgrade yq-debugsourceUpgrade runc-debuginfo | Mar 27, 2026 | Mar 6, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 6, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 9.4.12 | Jul 30, 2026 | Mar 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub