Google Go up to 1.25.7/1.26.0 refresh cross site scripting

Summaryinfo

A vulnerability was found in Google Go up to 1.25.7/1.26.0 and classified as problematic. Affected is an unknown function. Executing a manipulation of the argument refresh can lead to cross site scripting. This vulnerability is tracked as CVE-2026-27142. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Go up to 1.25.7/1.26.0. It has been declared as problematic. This vulnerability affects an unknown code. The manipulation of the argument refresh with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

The advisory is shared for download at groups.google.com. This vulnerability was named CVE-2026-27142 since 02/17/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/01/2026). The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability scanner Nessus provides a plugin with the ID 301393 (Linux Distros Unpatched Vulnerability : CVE-2026-27142), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.8 or 1.26.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (301393) and CERT Bund (WID-SEC-2026-0548). Once again VulDB remains the best source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Golang Go

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.25.0
• 1.25.1
• 1.25.2
• 1.25.3
• 1.25.4
• 1.25.5
• 1.25.6
• 1.25.7
• 1.26.0

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion