CVE-2026-27142
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Mar 6, 2026
CISA due date
—
The record
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | actions-runner-controller | 0 | 0 |
| Chainguard | actions-runner-controller-fips | 0 | 0 |
| Chainguard | addon-resizer | 0 | 0 |
| Chainguard | addon-resizer-fips | 0 | 0 |
| Chainguard | age | 0 | 0 |
| Chainguard | agentbeat | 0 | 9.2.4-r5 |
| Chainguard | agentbeat-fips | 0 | 9.2.4-r5 |
| Chainguard | amass | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent | 0 | 1.300064.1-r1 |
| Chainguard | amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-config-downloader | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-config-downloader-fips | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-config-translator | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-config-translator-fips | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-fips | 0 | 1.300064.1-r2 |
| Chainguard | amazon-cloudwatch-agent-operator | 0 | 3.3.2-r1 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 0 | 3.3.2-r2 |
| Chainguard | amazon-cloudwatch-agent-start-amazon-cloudwatch-agent | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips | 0 | 0 |
| Chainguard | amazon-ecs-agent | 0 | 1.102.0-r2 |
| Chainguard | amazon-ecs-agent-fips | 0 | 1.102.0-r2 |
| Chainguard | amazon-k8s-cni | 0 | 1.22.0-r1 |
| Chainguard | amazon-k8s-cni-fips | 0 | 1.22.0-r1 |
| Chainguard | amazon-k8s-cni-init | 0 | 0 |
| Chainguard | amazon-k8s-cni-init-fips | 0 | 0 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 0 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 0 |
| Chainguard | amazon-ssm-agent-fips | 0 | 0 |
| Chainguard | apache-beam-java-11-sdk | 0 | 2.71.0-r3 |
| Chainguard | apache-beam-java-17-sdk | 0 | 2.71.0-r3 |
| Chainguard | apache-beam-java-21-sdk | 0 | 2.71.0-r3 |
| Chainguard | apache-exporter | 0 | 1.0.12-r4 |
| Chainguard | apisix-ingress-controller | 0 | 2.0.1-r5 |
| Chainguard | apm-server-7.17 | 0 | 7.17.29-r12 |
| Chainguard | apm-server-8.17 | 0 | 8.17.10-r8 |
| Chainguard | apm-server-8.18 | 0 | 8.18.8-r7 |
| Chainguard | apm-server-8.19 | 0 | 8.19.12-r3 |
| Chainguard | apm-server-9.0 | 0 | 9.0.8-r5 |
| Chainguard | apm-server-9.1 | 0 | 9.1.10-r4 |
| Chainguard | apm-server-9.2 | 0 | 9.2.6-r3 |
| Chainguard | apm-server-9.3 | 0 | 9.3.1-r3 |
| Chainguard | apm-server-fips-7.17 | 0 | 7.17.29-r12 |
| Chainguard | apm-server-fips-8.17 | 0 | 8.17.10-r7 |
| Chainguard | apm-server-fips-8.18 | 0 | 8.18.8-r7 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.12-r3 |
| Chainguard | apm-server-fips-9.0 | 0 | 0 |
| Chainguard | apm-server-fips-9.1 | 0 | 0 |
| Chainguard | apm-server-fips-9.2 | 0 | 0 |
| Chainguard | apm-server-fips-9.3 | 0 | 0 |
| Chainguard | argo-cd-2.14 | 0 | 2.14.21-r10 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r10 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r4 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r4 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.12-r6 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.7-r2 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.7-r2 |
| Chainguard | argo-cd-fips-2.14 | 0 | 2.14.21-r9 |
| Chainguard | argo-cd-fips-2.14-compat | 0 | 2.14.21-r9 |
| Chainguard | argo-cd-fips-3.0 | 0 | 3.0.23-r5 |
| Chainguard | argo-cd-fips-3.0-compat | 0 | 3.0.23-r5 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.12-r5 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.12-r5 |
| Chainguard | argo-events | 0 | 1.9.10-r5 |
| Chainguard | argo-events-fips | 0 | 1.9.10-r4 |
| Chainguard | argo-rollouts | 0 | 1.8.4-r4 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.4-r5 |
| Chainguard | argo-workflow-controller-fips-3.6 | 0 | 3.6.19-r4 |
| Chainguard | argo-workflow-controller-fips-3.7 | 0 | 3.7.10-r5 |
| Chainguard | argo-workflow-executor-fips-3.6 | 0 | 3.6.19-r4 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.10-r5 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.1-r6 |
| Chainguard | argo-workflows-fips-3.6 | 0 | 3.6.19-r4 |
| Chainguard | argo-workflows-fips-3.7 | 0 | 3.7.10-r5 |
| Chainguard | argocd-image-updater | 0 | 1.1.1-r3 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.1-r4 |
| Chainguard | atlantis | 0 | 0.40.0-r3 |
| Chainguard | atlantis-fips | 0 | 0.40.0-r5 |
| Chainguard | auditbeat-8.17 | 0 | 8.17.10-r11 |
| Chainguard | auditbeat-8.18 | 0 | 8.18.8-r12 |
| Chainguard | auditbeat-8.19 | 0 | 8.19.12-r2 |
| Chainguard | auditbeat-9.0 | 0 | 9.0.8-r10 |
| Chainguard | auditbeat-9.2 | 0 | 9.2.6-r3 |
| Chainguard | auditbeat-9.3 | 0 | 9.3.1-r3 |
| Chainguard | auditbeat-fips-7 | 0 | 7.17.29-r13 |
| Chainguard | auditbeat-fips-8.17 | 0 | 8.17.10-r9 |
| Chainguard | auditbeat-fips-8.18 | 0 | 8.18.8-r10 |
| Chainguard | auditbeat-fips-8.19 | 0 | 8.19.12-r2 |
| Chainguard | auditbeat-fips-9.0 | 0 | 9.0.8-r9 |
| Chainguard | auditbeat-fips-9.1 | 0 | 9.1.10-r6 |
| Chainguard | auditbeat-fips-9.2 | 0 | 9.2.6-r2 |
| Chainguard | auditbeat-fips-9.3 | 0 | 0 |
| Chainguard | authentik-go-server | 0 | 2026.2.1-r2 |
| Chainguard | authservice | 0 | 1.1.5-r4 |
| Chainguard | authservice-fips | 0 | 1.1.5-r5 |
| Chainguard | aws-application-networking-k8s | 0 | 0 |
| Chainguard | aws-application-networking-k8s-fips | 0 | 0 |
| Chainguard | aws-ebs-csi-driver-1.50 | 0 | 1.50.3-r6 |
| Chainguard | aws-ebs-csi-driver-1.51 | 0 | 1.51.2-r6 |
| Chainguard | aws-ebs-csi-driver-1.52 | 0 | 1.52.1-r7 |
| Chainguard | aws-ebs-csi-driver-1.53 | 0 | 1.53.0-r6 |
| Chainguard | aws-ebs-csi-driver-1.54 | 0 | 1.54.0-r6 |
| Chainguard | aws-ebs-csi-driver-1.55 | 0 | 1.55.0-r3 |
| Chainguard | aws-ebs-csi-driver-1.56 | 0 | 1.56.0-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 1.50.3-r6 |
| Chainguard | aws-ebs-csi-driver-fips-1.51 | 0 | 1.51.2-r6 |
| Chainguard | aws-ebs-csi-driver-fips-1.52 | 0 | 1.52.1-r6 |
| Chainguard | aws-ebs-csi-driver-fips-1.53 | 0 | 1.53.0-r6 |
| Chainguard | aws-ebs-csi-driver-fips-1.54 | 0 | 1.54.0-r5 |
| Chainguard | aws-ebs-csi-driver-fips-1.55 | 0 | 1.55.0-r4 |
| Chainguard | aws-ebs-csi-driver-fips-1.56 | 0 | 1.56.0-r3 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 2.3.0-r5 |
| Chainguard | aws-eks-pod-identity-agent | 0 | 0 |
| Chainguard | aws-eks-pod-identity-agent-fips | 0 | 0 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r21 |
| Chainguard | aws-flb-firehose-fips | 0 | 1.7.2-r20 |
| Chainguard | aws-flb-kinesis | 0 | 1.10.3-r7 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.3-r8 |
| Chainguard | aws-fsx-csi-driver | 0 | 1.8.0-r4 |
| Chainguard | aws-fsx-csi-driver-fips | 0 | 1.8.0-r4 |
| Chainguard | aws-iam-authenticator | 0 | 0 |
| Chainguard | aws-iam-authenticator-fips | 0 | 0 |
| Chainguard | aws-load-balancer-controller | 0 | 3.1.0-r2 |
| Chainguard | aws-load-balancer-controller-fips | 0 | 0 |
| Chainguard | aws-network-policy-agent-fips | 0 | 0 |
| Chainguard | aws-node-termination-handler-fips | 0 | 1.25.5-r1 |
| Chainguard | aws-nuke | 0 | 0 |
| Chainguard | aws-nuke-fips | 0 | 0 |
| Chainguard | aws-otel-collector | 0 | 0.47.0-r7 |
| Chainguard | aws-otel-collector-fips | 0 | 0.47.0-r4 |
| Chainguard | aws-otel-collector-healthcheck | 0 | 0 |
| Chainguard | aws-otel-collector-healthcheck-fips | 0 | 0 |
| Chainguard | aws-privateca-issuer | 0 | 0 |
| Chainguard | aws-privateca-issuer-fips | 0 | 0 |
| Chainguard | aws-s3-controller | 0 | 0 |
| Chainguard | aws-signer-notation-plugin | 0 | 0 |
| Chainguard | aws-signer-notation-plugin-fips | 0 | 0 |
| Chainguard | aws-sigv4-proxy | 0 | 0 |
| Chainguard | aws-sigv4-proxy-fips | 0 | 0 |
| Chainguard | azcopy | 0 | 10.32.1-r7 |
| Chainguard | azcopy-fips | 0 | 10.32.1-r3 |
| Chainguard | azure-aad-pod-identity-mic | 0 | 1.8.17-r34 |
| Chainguard | azure-aad-pod-identity-nmi | 0 | 1.8.17-r34 |
| Chainguard | azure-ipam | 0 | 0 |
| Chainguard | azure-ipam-dropgz | 0 | 0 |
| Chainguard | azure-service-operator | 0 | 2.18.0-r4 |
| Chainguard | azure-service-operator-fips | 0 | 2.18.0-r3 |
| Chainguard | azure-vnet-cni | 0 | 1.7.12-r3 |
| Chainguard | azure-workload-identity-webhook | 0 | 0 |
| Chainguard | azuredisk-csi-1.28 | 0 | 1.28.12-r16 |
| Chainguard | azuredisk-csi-1.29 | 0 | 1.29.14-r15 |
| Chainguard | azuredisk-csi-1.30 | 0 | 1.30.12-r14 |
| Chainguard | azuredisk-csi-1.31 | 0 | 1.31.12-r10 |
| Chainguard | azuredisk-csi-1.32 | 0 | 1.32.12-r4 |
| Chainguard | azuredisk-csi-1.33 | 0 | 1.33.8-r5 |
| Chainguard | azuredisk-csi-1.34 | 0 | 1.34.2-r3 |
| Chainguard | azuredisk-csi-fips-1.28 | 0 | 1.28.12-r15 |
| Chainguard | azuredisk-csi-fips-1.29 | 0 | 1.29.14-r14 |
| Chainguard | azuredisk-csi-fips-1.30 | 0 | 1.30.12-r13 |
| Chainguard | azuredisk-csi-fips-1.31 | 0 | 1.31.12-r10 |
| Chainguard | azuredisk-csi-fips-1.32 | 0 | 1.32.12-r4 |
| Chainguard | azuredisk-csi-fips-1.33 | 0 | 1.33.8-r5 |
| Chainguard | azuredisk-csi-fips-1.34 | 0 | 1.34.2-r2 |
| Chainguard | azurefile-csi-1.31 | 0 | 1.31.8-r11 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.9-r7 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.8-r2 |
| Chainguard | azurefile-csi-1.34 | 0 | 1.34.4-r2 |
| Chainguard | azurefile-csi-1.35 | 0 | 1.35.1-r5 |
| Chainguard | azurefile-csi-fips-1.31 | 0 | 1.31.8-r12 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.9-r6 |
| Chainguard | azurefile-csi-fips-1.33 | 0 | 1.33.8-r2 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.4-r2 |
| Chainguard | azurefile-csi-fips-1.35 | 0 | 1.35.1-r2 |
| Chainguard | backup-restore-operator-7.0 | 0 | 7.0.5-r4 |
| Chainguard | backup-restore-operator-8.1 | 0 | 8.1.2-r3 |
| Chainguard | backup-restore-operator-9.0 | 0 | 9.0.1-r4 |
| Chainguard | backup-restore-operator-fips-7.0 | 0 | 7.0.5-r4 |
| Chainguard | backup-restore-operator-fips-8.1 | 0 | 8.1.2-r4 |
| Chainguard | backup-restore-operator-fips-9.0 | 0 | 9.0.1-r4 |
| Chainguard | bank-vaults | 0 | 1.32.1-r6 |
| Chainguard | bank-vaults-fips | 0 | 1.32.1-r2 |
| Chainguard | bank-vaults-template | 0 | 1.32.1-r6 |
| Chainguard | bank-vaults-template-fips | 0 | 1.32.1-r2 |
| Chainguard | bento-fips | 0 | 1.15.1-r0 |
| Chainguard | blob-csi-1.23 | 0 | 1.23.11-r66 |
| Chainguard | blob-csi-1.24 | 0 | 1.24.11-r15 |
| Chainguard | blob-csi-1.25 | 0 | 1.25.10-r12 |
| Chainguard | blob-csi-1.26 | 0 | 1.26.10-r2 |
| Chainguard | blob-csi-1.27 | 0 | 1.27.3-r2 |
| Chainguard | blob-csi-fips-1.23 | 0 | 1.23.11-r68 |
| Chainguard | blob-csi-fips-1.24 | 0 | 1.24.11-r15 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r12 |
| Chainguard | blob-csi-fips-1.26 | 0 | 1.26.10-r1 |
| Chainguard | blob-csi-fips-1.27 | 0 | 1.27.3-r1 |
| Chainguard | blobfuse2 | 0 | 2.4.2-r12 |
| Chainguard | blobfuse2-fips | 0 | 2.4.2-r11 |
| Chainguard | blobfuse2-fips-health-monitor | 0 | 0 |
| Chainguard | blobfuse2-health-monitor | 0 | 0 |
| Chainguard | bom | 0 | 0.7.1-r10 |
| Chainguard | boring-registry | 0 | 0.16.6-r13 |
Related vulnerabilities
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects actions-runner-controller
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects actions-runner-controller
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects actions-runner-controller
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects actions-runner-controller
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects actions-runner-controller
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects actions-runner-controller
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects actions-runner-controller
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects actions-runner-controller