What’s Vulnerable › Vulnerabilities

CVE-2023-39319: Improper handling of special tags within script contexts in html/template

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-08 · updated 2026-06-17
• Weakness: CWE-79

Description

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Affected products

• Go: before 1.20.8; from 1.21.0 before 1.21.1 — fixed in 1.20.8, 1.21.1

How to fix

Upgrade to a fixed version: Go 1.20.8, 1.21.1. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/526157
• https://go.dev/issue/62197
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
• https://pkg.go.dev/vuln/GO-2023-2043
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20231020-0009/
• https://go.dev/cl/526157
• https://go.dev/issue/62197
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
• https://pkg.go.dev/vuln/GO-2023-2043
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20231020-0009/

Get alerted when CVE-2023-39319 or the next vulnerability affects your stack