GO-2023-1753

vendorUSosv

Improper handling of empty HTML attributes in html/template

view advisory published 2023-05-05Licence: per source

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-29400US	high7.3	1.04% (64th)	—	2023-05-11
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normaliz…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/491617FIX
https://go.dev/issue/59722REPORT
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan