CVE-2024-24785

2024-03-0523:15:07

[email protected]

web.nvd.nist.gov

cve-2024-24785

marshaljson methods

contextual auto-escaping

html/template package

injection vulnerability

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "html/template",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "html/template",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.21.8",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.22.0-0",
        "lessThan": "1.22.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "jsValEscaper"
      },
      {
        "name": "escaper.commit"
      },
      {
        "name": "Template.Execute"
      },
      {
        "name": "Template.ExecuteTemplate"
      }
    ],
    "defaultStatus": "unaffected"
  }
]