CVE-2023-39318
MediumSummary
The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to Cross-Site Scripting (XSS) attacks and compromising user data security.
Recommendation
Immediately update the html/template package to a patched version (e.g., Go 1.21.1 or later). Review and test all HTML templates for potential attack vectors.
Original NVD description (English source)
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to per