The vulnerability originates from an escape function that fails to properly neutralize URLs placed inside a <meta> tag’s <content> attribute when the URL contains ASCII whitespace around the equals sign. An attacker can therefore inject a malicious URL crafted to bypass the escaping mechanism, resulting in the execution of arbitrary JavaScript in a visitor’s browser. This client‑side code execution can lead to theft of session cookies, credential compromise, or execution of further malicious actions within the context of the web page.

The issue resides in Go’s standard library package html/template. Any Go application that renders HTML via this package and incorporates user‑controlled input into a <meta> content attribute is potentially vulnerable. The specific vulnerable Go releases are those released before the patch that corrected the escaping logic; explicit version ranges are not provided in the CVE record.

The attack vector is purely client‑side: an attacker must supply or influence content that is rendered into a template. Once an end‑user loads the page, the crafted script runs with the privileges of that web application. Although the CVSS score and EPSS value are not included, the existence of a functional XSS flaw with broad exposure warrants a high severity assessment. The vulnerability is not listed in CISA’s KEV catalog, but the potential impact remains significant due to the prevalence of Go in web services.