GHSA-2wrh-6pvc-2jm9

Source

https://github.com/advisories/GHSA-2wrh-6pvc-2jm9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-2wrh-6pvc-2jm9/GHSA-2wrh-6pvc-2jm9.json

Aliases

• CVE-2023-3978
• GO-2023-1988

Published

2023-08-02T21:30:20Z

Modified

2023-11-08T04:13:15.499029Z

Details

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-3978
• https://go.dev/cl/514896
• https://go.dev/issue/61615
• https://pkg.go.dev/vuln/GO-2023-1988