CVE-2024-24785
MediumSummary
A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious HTML or JavaScript into template-generated pages, potentially leading to XSS attacks and user data theft.
Recommendation
Update the Go environment to a version containing the fix for CVE-2024-24785 and avoid returning user data in errors from MarshalJSON methods.
Original NVD description (English source)
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.