5.4
Moyenne
CVE-2024-24785 If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual…
Description
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| html/template 1.22 | 1.22.0-0 → < 1.22.1 | 1.22.1 |
| html/template 1.21 | premières → < 1.21.8 | 1.21.8 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.netapp.com security.netapp.com
- www.openwall.com www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de html/template
Les 14 CVE de html/template →
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset…
6.1
Moyenne
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would…
6.1
Moyenne
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject…
6.1
Moyenne
CVE-2026-39826
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an…
6.1
Moyenne