Detections
Analytics
Golang: stdlib: security update to 1.25.8stdlib: security update to 1.26.1
medium Tenable Cloud Security Plugin ID 438451
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS
if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been
added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content
attribute which follow "url=" by setting htmlmetacontenturlescape=0. (CVE-2026-27142)
See Also
Plugin Details
Severity: Medium
ID: 438451
Version: Revision 1.9
Type: Local
Family: Golang
Published: 3/7/2026
Updated: 6/15/2026
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-27142
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/6/2026
Vulnerability Publication Date: 3/5/2026
Reference Information
CVE: CVE-2026-27142