CVE-2023-29400: Improper handling of empty HTML attributes in html/template
Golang Go is vulnerable to HTML injection. A remote attacker could inject malicious HTML code into the templates, which when parsed, would execute in the victim's Web browser within the security context of the hosting site.
Other sources
Improper handling of empty HTML attributes in html/template
— Microsoft
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
— Debian
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input could result in output that would have unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-29400.
What is the severity level of CVE-2023-29400?
The severity level of CVE-2023-29400 is high with a score of 7.3.
What is the description of CVE-2023-29400?
CVE-2023-29400 is a vulnerability where templates containing actions in unquoted HTML attributes executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules, allowing injection of arbitrary attributes into tags.
Which software versions are affected by CVE-2023-29400?
The affected software versions are golang 1.19.9 and golang 1.20.4 (up to exclusive).
Are there any references available for CVE-2023-29400?
Yes, you can find references for CVE-2023-29400 at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196474), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2196475), [link3](https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU).