CVE-2026-27142 fixed a vulnerability in which URLs were not
correctly escaped inside of a tag's attribute.
If the URL content were to insert ASCII whitespaces around the
= rune inside of the attribute, the escaper would
fail to similarly escape it, leading to XSS.

Dynamic inputs to a tag's attribute are now
whitespace sanitized prior to escaping.

Thanks to Samy Ghannad for reporting this issue.

This is CVE-2026-39823 and Go issue https://go.dev/issue/78913.

This was a PUBLIC track issue, tracked in http://b/495820486.