CVE-2023-29400

Improper handling of empty HTML attributes in html/template

State: Published
Severity: 7.3 High
Published: May 11, 2023
Updated: Jan 24, 2025
Reserved: Apr 5, 2023

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
html/templateGo standard library	before 1.19.9Affected 1.20.0-0 to before 1.20.4Affected

References

https://go.dev/issue/59722
https://go.dev/cl/491617
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
https://pkg.go.dev/vuln/GO-2023-1753
https://security.netapp.com/advisory/ntap-20241213-0005/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.