Unrated severityNVD Advisory· Published May 11, 2023· Updated Jan 24, 2025

Improper handling of JavaScript whitespace in html/template

CVE-2023-24540

Description

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Affected products

osv-coords75 versions
pkg:apk/chainguard/falco pkg:apk/chainguard/falco-dev pkg:apk/chainguard/falco-src pkg:apk/chainguard/go-1.19 pkg:apk/chainguard/go-1.19-doc pkg:apk/chainguard/go-1.20 pkg:apk/chainguard/go-1.20-doc pkg:apk/chainguard/go-fips-1.20 pkg:apk/chainguard/go-fips-1.20-doc pkg:apk/wolfi/falco pkg:apk/wolfi/falco-dev pkg:apk/wolfi/falco-src pkg:apk/wolfi/go-1.19 pkg:apk/wolfi/go-1.19-doc pkg:apk/wolfi/go-1.20 pkg:apk/wolfi/go-1.20-doc pkg:apk/wolfi/go-fips-1.20 pkg:apk/wolfi/go-fips-1.20-doc pkg:bitnami/golang pkg:rpm/almalinux/aardvark-dns pkg:rpm/almalinux/buildah pkg:rpm/almalinux/buildah-tests pkg:rpm/almalinux/cockpit-podman pkg:rpm/almalinux/conmon pkg:rpm/almalinux/containernetworking-plugins pkg:rpm/almalinux/containers-common pkg:rpm/almalinux/container-selinux pkg:rpm/almalinux/crit pkg:rpm/almalinux/criu pkg:rpm/almalinux/criu-devel pkg:rpm/almalinux/criu-libs pkg:rpm/almalinux/crun pkg:rpm/almalinux/delve pkg:rpm/almalinux/fuse-overlayfs pkg:rpm/almalinux/golang pkg:rpm/almalinux/golang-bin pkg:rpm/almalinux/golang-docs pkg:rpm/almalinux/golang-misc pkg:rpm/almalinux/golang-race pkg:rpm/almalinux/golang-src pkg:rpm/almalinux/golang-tests pkg:rpm/almalinux/go-toolset pkg:rpm/almalinux/libslirp pkg:rpm/almalinux/libslirp-devel pkg:rpm/almalinux/netavark pkg:rpm/almalinux/oci-seccomp-bpf-hook pkg:rpm/almalinux/podman pkg:rpm/almalinux/podman-catatonit pkg:rpm/almalinux/podman-docker pkg:rpm/almalinux/podman-gvproxy pkg:rpm/almalinux/podman-plugins pkg:rpm/almalinux/podman-remote pkg:rpm/almalinux/podman-tests pkg:rpm/almalinux/python3-criu pkg:rpm/almalinux/python3-podman pkg:rpm/almalinux/runc pkg:rpm/almalinux/skopeo pkg:rpm/almalinux/skopeo-tests pkg:rpm/almalinux/slirp4netns pkg:rpm/almalinux/toolbox pkg:rpm/almalinux/toolbox-tests pkg:rpm/almalinux/udica pkg:rpm/opensuse/go1.19&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.19&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Tumbleweed pkg:rpm/suse/go1.19&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3
< 0.37.1-r0+ 74 more
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.19.9
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 46-1.module_el8.7.0+3344+5bcd850f
- (no CPE)range: < 2:2.1.4-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.3.0-4.el9
- (no CPE)range: < 2:1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:2.205.0-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 1.8.3-1.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.9.1-1.module_el8.8.0+3471+a62632a0
- (no CPE)range: < 1.9-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-2.el9_2
- (no CPE)range: < 1.19.9-1.el9_2
- (no CPE)range: < 4.4.0-1.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 4.4.0-1.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.2.5-2.module_el8.8.0+3468+16b86c82
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.0.2-24.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 4.0.0-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 1.1.8-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.2.6-4.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-1.1
- (no CPE)range: < 1.20.4-150000.1.11.1
- (no CPE)range: < 1.20.4-1.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.20.4-150000.1.11.1
- (no CPE)range: < 1.20.4-150000.1.11.1
Go standard library/html/templatev5
Range: 0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

go.dev/cl/491616mitre
go.dev/issue/59721mitre
groups.google.com/g/golang-announce/c/MEb0UyuSMsUmitre
pkg.go.dev/vuln/GO-2023-1752mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000