VDB
GO-2026-4603
GO-2026-4603
PUBLISHED
CVSS 9.300000190734863 CRITICAL
URLs in meta content attribute actions are not escaped in html/template
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | gitlab-pages-18.9 | 0 |
| chainguard | opencost | 0 |
| chainguard | flux-fips-2.6 | * |
| chainguard | json-exporter | 0 |
| chainguard | kuma-2.11 | * |
| chainguard | whereabouts-fips | * |
| chainguard | kubescape-server | 0 |
| chainguard | gcp-compute-persistent-disk-csi-driver-fips-1.19 | 0 |
| chainguard | gosu-fips | * |
| chainguard | nri-mysql | * |
| chainguard | metallb | * |
| chainguard | rabbitmq-messaging-topology-operator | * |
| chainguard | aws-sigv4-proxy | * |
| chainguard | gitlab-workhorse-ce-18.9 | * |
| wolfi | influx | * |
| wolfi | cilium-envoy-1.19 | 0 |
| chainguard | k8s-metacollector-fips | 0 |
| wolfi | knative-operator-1.21 | 0 |
| chainguard | snyk-cli | 0 |
| chainguard | mongodb-k8s-operator-version-upgrade-post-start-hook | * |
…and 2158 more
Timeline
- Mar 6, 2026 CVE Published
- May 15, 2026 CVE Updated