CVE-2023-24540 Improper handling of JavaScript whitespace in html/template

2023-05-1115:29:31

www.cve.org

javascript whitespace

html/template

sanitization

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set “\t\n\f\r\u0020\u2028\u2029” in JavaScript contexts that also contain actions may not be properly sanitized during execution.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "html/template",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "html/template",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.19.9",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.20.0-0",
        "lessThan": "1.20.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "nextJSCtx"
      },
      {
        "name": "Template.Execute"
      },
      {
        "name": "Template.ExecuteTemplate"
      }
    ],
    "defaultStatus": "unaffected"
  }
]