Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2023-29400

Improper handling of empty HTML attributes in html/template

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library html/template

Default version status: unaffected

  • 0 to < 1.19.9affected
  • 1.20.0-0 to < 1.20.4affected

References