PT-2026-23665 · Amazon+1 · Aws-Lambda+1

Published 2026-03-06 · Updated 2026-03-09 · CVE-2026-27142

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions AWS Lambda (affected versions not specified)

Description Actions that insert URLs into the content attribute of HTML meta tags are not properly escaped. This can lead to cross-site scripting (XSS) if the meta tag also includes an http-equiv attribute set to "refresh". A new GODEBUG setting,

htmlmetacontenturlescape

, has been introduced to control URL escaping in actions within the meta content attribute following "url=". Disabling URL escaping can be achieved by setting

htmlmetacontenturlescape

to 0. The issue impacts stdlib in 27 Lambda base images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-27142

GO-2026-4603

OPENSUSE-SU-2026:10299-1

Affected Products

Aws-Lambda

Stdlib

References · 19

• https://osv.dev/vulnerability/GO-2026-4603 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10299-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://suse.com/security/cve/CVE-2026-27142 · Note
• https://suse.com/security/cve/CVE-2026-27139 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://go.dev/issue/77954 · Note
• https://t.me/CVEtracker/46660 · Telegram Post
• https://twitter.com/infoflowcloud/status/2030340548372898013 · Twitter Post
• https://twitter.com/CVEnew/status/2030339379361992778 · Twitter Post
• https://twitter.com/golang/status/2029728083977048189 · Twitter Post
• https://suse.com/security/cve/CVE-2026-25679 · Note
• https://twitter.com/LambdaWatchdog/status/2030252373575156107 · Twitter Post
• https://twitter.com/oss_security/status/2030835523946688610 · Twitter Post
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk · Note