CVE-2023-39318
- Source
- https://cve.org/CVERecord?id=CVE-2023-39318
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39318.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-39318
- Aliases
- Downstream
- Related
- Published
- 2023-09-08T17:15:27.823Z
- Modified
- 2026-02-04T21:35:24.782074Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
- References
-
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- https://pkg.go.dev/vuln/GO-2023-2041
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20231020-0009/
- https://go.dev/issue/62196
- https://go.dev/cl/526156
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ