CVE-2023-39318
MediumSummary
The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to Cross-Site Scripting (XSS) attacks and compromising user data security.
Recommendation
Immediately update the html/template package to a patched version (e.g., Go 1.21.1 or later). Review and test all HTML templates for potential attack vectors.
Other vulnerabilities in html/template
See all- CVE-2024-24785Medium
A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.
- CVE-2023-39319Medium
The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.
Original NVD description (English source)
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to per
Vulnerability data from NVD (NIST) · CISA KEV · EPSS