Technical impact
The vulnerability stems from the Go standard library’s html/template package, which fails to escape URLs correctly when the URL contains ASCII whitespace around the equals sign inside a <meta> tag’s content attribute. This escape failure permits an attacker to inject malicious script, resulting in arbitrary JavaScript execution within the victim’s browser. The weakness aligns with CWE‑79, Cross‑Site Scripting.
Affected Systems
The affected product is the Go standard library (html/template). Any Go application that renders HTML using this package and inserts user‑controlled data into a <meta> tag’s content attribute is potentially vulnerable, provided it is running a Go release prior to the fix. No explicit version ranges are listed, but the patch was included in later standard library releases following the issue closure.
Risk and Exploitability
The likely attack vector is client‑side: an attacker supplies or manipulates data that ends up in a template that generates a <meta> tag, and then causes an end user’s browser to load the crafted page. The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. This vulnerability is not listed in CISA’s KEV catalog, but because Go is widely used for web services, any unpatched application could expose its users to malicious script execution.
