Lucene search

K
osvGoogleOSV:BIT-GOLANG-2023-29400
HistoryMar 06, 2024 - 10:55 a.m.

BIT-golang-2023-29400

2024-03-0610:55:58
Google
osv.dev
5
html
attribute
injection
risk
input
software

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

Templates containing actions in unquoted HTML attributes (e.g. “attr={{.}}”) executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

CPENameOperatorVersion
golanglt1.19.9
golangge1.20.0
golanglt1.20.4