CVE-2023-39319: Improper handling of special tags within script contexts in html/template
Golang Go is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the html/template package. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Improper handling of special tags within script contexts in html/template
— Microsoft
The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
— Red Hat
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-39319.
What is the severity of CVE-2023-39319?
The severity of CVE-2023-39319 is medium with a CVSS score of 6.1.
Which software is affected by CVE-2023-39319?
Golang Go versions up to 1.20.8 and versions between 1.21.0 and 1.21.1 are affected by CVE-2023-39319.
How does CVE-2023-39319 affect the html/template package?
CVE-2023-39319 affects the html/template package by improperly handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts, causing actions to be improperly escaped.
How can I fix CVE-2023-39319?
To fix CVE-2023-39319, it is recommended to update Golang Go to versions 1.20.8 or 1.21.2 or later.