GO-2023-1988

Source
https://pkg.go.dev/vuln/GO-2023-1988
Import Source
https://vuln.go.dev/ID/GO-2023-1988.json
Aliases
Published
2023-08-02T15:06:27Z
Modified
2023-11-08T04:13:15.499029Z
Details

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

References

Affected packages

Go / golang.org/x/net

Package

Name
golang.org/x/net

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.13.0

Ecosystem specific 

{
    "imports": [
        {
            "path": "golang.org/x/net/html",
            "symbols": [
                "Render",
                "render1"
            ]
        }
    ]
}