Skip to content
Sign in

Known vulnerabilities in Go standard library html/template

Is your version affected?

CVE list

CVE Summary Score Published
CVE-2023-24540 Not all valid JavaScript whitespace characters are considered to be whitespace 9.8 Critical May 11, 2023
CVE-2023-24538 Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected 9.8 Critical Apr 6, 2023

Other Go standard library products

net/http 26 crypto/x509 15 crypto/tls 13 os 6 net/textproto 6 path/filepath 6 net/http/internal/http2 6 net/url 5 net 4 net/mail 4 mime/multipart 3 encoding/xml 3