Astra Linux – Vulnerability in Golang 1.15, Golang 1.19

Actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs. This can lead to XSS attacks if the meta tag also contains an http-equiv attribute with the value “refresh”. A new GODEBUG setting, htmlmetacontenturlescape, has been added, which can be used to disabl...