CVE-2023-24540: Improper handling of JavaScript whitespace in html/template
Go is vulnerable to HTML injection. A remote attacker could inject malicious HTML code into a template containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029", which when viewed, would execute in the victim's Web browser within the security context of the hosting site.
Other sources
Improper handling of JavaScript whitespace in html/template
— Microsoft
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
— Debian
Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-24540?
CVE-2023-24540 is a vulnerability that affects JavaScript contexts with actions that may not properly sanitize templates containing whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in the Go programming language.
How severe is CVE-2023-24540?
CVE-2023-24540 has a severity rating of 9.8 (critical).
Which software packages are affected by CVE-2023-24540?
The affected software packages are golang versions up to and excluding 1.19.9 and golang versions within the range 1.20.0 to 1.20.4.
How can I fix CVE-2023-24540?
To fix CVE-2023-24540, update to golang version 1.19.9 or install a version within the range 1.20.0 to 1.20.4.
Where can I find more information about CVE-2023-24540?
You can find more information about CVE-2023-24540 in the following references: 1. [Bugzilla - CVE-2023-24540](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196629) 2. [Bugzilla - CVE-2023-24540](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196630) 3. [Golang Announce - CVE-2023-24540](https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU)