Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

Description

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library html/template

Default version status: unaffected

  • 0 to < 1.19.9affected
  • 1.20.0-0 to < 1.20.4affected

References