CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rcloneUpgrade go | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade runfinch-finchUpgrade golang-docsUpgrade cri-tools-debuginfoUpgrade amazon-ecr-credential-helper-debuginfoUpgrade cri-toolsUpgrade docker-debuginfoUpgrade rclone-debuginfoUpgrade containerd-stressUpgrade runcUpgrade oci-add-hooksUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade nerdctlUpgrade nerdctl-debuginfoUpgrade golang-sharedUpgrade golang-binUpgrade golist-debuginfoUpgrade cni-plugins-debuginfoUpgrade oci-add-hooks-debuginfoUpgrade golang-srcUpgrade soci-snapshotterUpgrade containerdUpgrade golang-miscUpgrade golistUpgrade golangUpgrade ecs-initUpgrade runc-debuginfoUpgrade golang-testsUpgrade containerd-debuginfoUpgrade dockerUpgrade rcloneUpgrade amazon-cloudwatch-agent | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade rclone-debugsourceUpgrade containerd-debugsourceUpgrade runc-debuginfoUpgrade soci-snapshotterUpgrade rclone-debuginfoUpgrade golang-testsUpgrade containerd-stressUpgrade golang-sharedUpgrade yq-debuginfoUpgrade golang-docsUpgrade amazon-ecr-credential-helperUpgrade containerdUpgrade dockerUpgrade oci-add-hooks-debuginfoUpgrade docker-debuginfoUpgrade containerd-debuginfoUpgrade rcloneUpgrade nerdctlUpgrade credentials-fetcherUpgrade yqUpgrade golangUpgrade ecs-initUpgrade containerd-stress-debuginfoUpgrade docker-debugsourceUpgrade golistUpgrade runc-debugsourceUpgrade runcUpgrade golist-debugsourceUpgrade golang-srcUpgrade yq-debugsourceUpgrade golang-miscUpgrade golist-debuginfoUpgrade golang-binUpgrade runfinch-finchUpgrade oci-add-hooksUpgrade oci-add-hooks-debugsource | May 28, 2026 | May 7, 2026 |
| Freebsd | — | Upgrade gohugo | Jun 15, 2026 | May 29, 2026 |
| Oracle_linux | — | Upgrade golang-binUpgrade golang-testsUpgrade golangUpgrade go-toolsetUpgrade golang-miscUpgrade golang-srcUpgrade golang-raceUpgrade golang-docsUpgrade delve | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade go-toolsetUpgrade golang-srcUpgrade delve-debuginfoUpgrade golangUpgrade golang-binUpgrade golang-miscUpgrade delve-debugsourceUpgrade delveUpgrade golang-testsUpgrade golang-docsUpgrade golang-raceNo solution exists | Jul 17, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade go-toolsetUpgrade golangUpgrade delve-debuginfoUpgrade golang-binUpgrade golang-raceUpgrade delveUpgrade delve-debugsource | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub