CVE-2023-24539
Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
- CVSS 3.1
- 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 1.04% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-94
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/491615Patch
- https://go.dev/issue/59720Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1751Vendor Advisory
- https://go.dev/cl/491615Patch
- https://go.dev/issue/59720Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1751Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241129-0005/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.