The Go standard library’s html/template package does not escape URLs that are inserted into the content attribute of meta tags. If a template renders a meta tag containing http-equiv="refresh" with a URL supplied from user input, the unescaped URL can be hijacked to inject arbitrary payloads, enabling a client‑side cross‑site scripting (XSS) attack. The flaw involves CWE‑79 and allows an attacker to execute arbitrary JavaScript in the context of the victim’s browser.

The affected component is the Go standard library’s html/template package used when rendering web pages. No specific product version is mentioned in the public data, but any Go installation that uses html/template to generate meta tags with dynamic URLs is potentially vulnerable until the library is updated to the patched release.

The flaw is scored as CVSS 6.1, indicating a moderate severity, and the EPSS score is below 1 %, suggesting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require the attacker to influence the content passed to the template, such as through a form or URL parameter, and the attack vector is most likely client‑side via a web page that includes a meta‑refresh tag. Successful exploitation could lead to credential theft, session hijacking, or other XSS‑based damage in the victim’s browser.