CVE-2024-24785
MediumSummary
A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious HTML or JavaScript into template-generated pages, potentially leading to XSS attacks and user data theft.
Recommendation
Update the Go environment to a version containing the fix for CVE-2024-24785 and avoid returning user data in errors from MarshalJSON methods.
Other vulnerabilities in html/template
See all- CVE-2023-39318Medium
The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.
- CVE-2023-39319Medium
The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.
Original NVD description (English source)
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS