Vulnerability Report: GO-2023-2041
- CVE-2023-39318
- Affects: html/template
- Published: Sep 07, 2023
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
Affected Packages
-
PathVersionsSymbols
-
before go1.20.8, from go1.21.0-0 before go1.21.1
Aliases
References
- https://go.dev/issue/62196
- https://go.dev/cl/526156
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- https://vuln.go.dev/ID/GO-2023-2041.json
Credits
- Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.