GO-2023-1751

vendorUSosv

Improper sanitization of CSS values in html/template

view advisory published 2023-05-05Licence: per source

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-24539US	high7.3	1.04% (64th)	—	2023-05-11
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpe…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/491615FIX
https://go.dev/issue/59720REPORT
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan