Go html/template CVE-2026-39823

Upgrade to Go 1.25.10 or later for the 1.25.x series, or to Go 1.26.3 or later for the 1.26.x series. These patched versions restore correct escaping of whitespace characters around equals signs in meta tag content attributes. Users unable to upgrade immediately should implement input validation on any user-controlled URLs destined for meta tag content attributes, specifically stripping or rejecting ASCII whitespace characters (space, tab, newline, carriage return) in positions immediately before or after equals signs. Additionally, adopt a Content Security Policy (CSP) header with script-src 'self' (or more restrictive) to provide defense-in-depth against XSS injection, though this does not replace the patch. For applications serving untrusted content in meta tags (e.g., social sharing previews), consider using a dedicated HTML sanitizer library (e.g., bluemonday for Go) in addition to template escaping, though note this adds processing overhead and must be carefully configured to not strip legitimate Open Graph metadata.