CVE-2023-39318

Description

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Weakness classification

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

• security@golang.org — Patch
• security@golang.org — Issue Tracking
• security@golang.org — Mailing List, Release Notes
• security@golang.org — Vendor Advisory
• security@golang.org
• security@golang.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory