CVE-2023-39318 Improper handling of HTML-like comments in script contexts in html/template

2023-09-0816:13:24

www.cve.org

cve-2023-39318

improper handling

html-like comments

script contexts

template package

xss attack

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “#!” comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "html/template",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "html/template",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.20.8",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "isComment"
      },
      {
        "name": "escaper.escapeText"
      },
      {
        "name": "tJS"
      },
      {
        "name": "tLineCmt"
      },
      {
        "name": "Template.Execute"
      },
      {
        "name": "Template.ExecuteTemplate"
      }
    ],
    "defaultStatus": "unaffected"
  }
]