by Kastro
Paper/Archive/CVE-2023-24540

CVE-2023-24540

Go standard library html/template — Improper handling of JavaScript whitespace in html/template

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.2.752 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Affected

ProductAffectedFixed inSource
html/template< 1.19.91.19.9CNA
html/template1.20.0-0 – < 1.20.41.20.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgo.dev/issue/59721refgo.dev/cl/491616refgroups.google.com/g/golang-announce/c/MEb0UyuSMsUrefpkg.go.dev/vuln/GO-2023-1752refsecurity.netapp.com/advisory/ntap-20241115-0008