Not rated
CVE-2023-39319 The html/template package does not apply the proper rules for handling occurrences of…
Description
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| html/template 1.21 | 1.21.0-0 → < 1.21.1 | 1.21.1 |
| html/template 1.20 | earliest → < 1.20.8 | 1.20.8 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.netapp.com security.netapp.com
- security.gentoo.org security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of html/template
The 14 CVEs of html/template →
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset…
6.1
Medium
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would…
6.1
Medium
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject…
6.1
Medium
CVE-2026-39826
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an…
6.1
Medium