GHSA-2wrh-6pvc-2jm9

ghsaUSosv

Improper rendering of text nodes in golang.org/x/net/html

view advisory published 2023-08-02Licence: CC-BY-4.0

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3978US	medium6.1	0.85% (58th)	—	2023-08-02
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/514896WEB
https://go.dev/issue/61615WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3978ADVISORY
https://pkg.go.dev/vuln/GO-2023-1988WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan