VulnerabilityModified
CVE-2023-24540
Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
CRITICAL 9.8EPSS 1.56%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.56% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/491616Patch
- https://go.dev/issue/59721Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1752Vendor Advisory
- https://go.dev/cl/491616Patch
- https://go.dev/issue/59721Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUMailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1752Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241115-0008/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.