High severity7.3NVD Advisory· Published May 11, 2023· Updated Jun 17, 2026

CVE-2023-29400

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Golang/Go2 versions
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*range: <1.19.9
- (no CPE)
osv-coords80 versions
pkg:apk/chainguard/falco pkg:apk/chainguard/falco-dev pkg:apk/chainguard/falco-src pkg:apk/chainguard/go-1.19 pkg:apk/chainguard/go-1.19-doc pkg:apk/chainguard/go-1.20 pkg:apk/chainguard/go-1.20-doc pkg:apk/chainguard/go-fips-1.20 pkg:apk/chainguard/go-fips-1.20-doc pkg:apk/chainguard/katib-earlystopping pkg:apk/chainguard/katib-suggestion-hyperband pkg:apk/chainguard/katib-suggestion-hyperopt pkg:apk/chainguard/katib-suggestion-nas-darts pkg:apk/chainguard/katib-suggestion-optuna-enas pkg:apk/chainguard/katib-suggestion-pbt-enas pkg:apk/chainguard/katib-suggestion-skopt-enas pkg:apk/wolfi/falco pkg:apk/wolfi/falco-dev pkg:apk/wolfi/falco-src pkg:apk/wolfi/go-1.19 pkg:apk/wolfi/go-1.19-doc pkg:apk/wolfi/go-1.20 pkg:apk/wolfi/go-1.20-doc pkg:apk/wolfi/go-fips-1.20 pkg:apk/wolfi/go-fips-1.20-doc pkg:apk/wolfi/katib-earlystopping pkg:apk/wolfi/katib-suggestion-hyperband pkg:apk/wolfi/katib-suggestion-hyperopt pkg:apk/wolfi/katib-suggestion-nas-darts pkg:apk/wolfi/katib-suggestion-optuna-enas pkg:apk/wolfi/katib-suggestion-pbt-enas pkg:apk/wolfi/katib-suggestion-skopt-enas pkg:bitnami/golang pkg:rpm/almalinux/aardvark-dns pkg:rpm/almalinux/buildah pkg:rpm/almalinux/buildah-tests pkg:rpm/almalinux/cockpit-podman pkg:rpm/almalinux/conmon pkg:rpm/almalinux/container-selinux pkg:rpm/almalinux/containernetworking-plugins pkg:rpm/almalinux/containers-common pkg:rpm/almalinux/crit pkg:rpm/almalinux/criu pkg:rpm/almalinux/criu-devel pkg:rpm/almalinux/criu-libs pkg:rpm/almalinux/crun pkg:rpm/almalinux/fuse-overlayfs pkg:rpm/almalinux/libslirp pkg:rpm/almalinux/libslirp-devel pkg:rpm/almalinux/netavark pkg:rpm/almalinux/oci-seccomp-bpf-hook pkg:rpm/almalinux/podman pkg:rpm/almalinux/podman-catatonit pkg:rpm/almalinux/podman-docker pkg:rpm/almalinux/podman-gvproxy pkg:rpm/almalinux/podman-plugins pkg:rpm/almalinux/podman-remote pkg:rpm/almalinux/podman-tests pkg:rpm/almalinux/python3-criu pkg:rpm/almalinux/python3-podman pkg:rpm/almalinux/runc pkg:rpm/almalinux/skopeo pkg:rpm/almalinux/skopeo-tests pkg:rpm/almalinux/slirp4netns pkg:rpm/almalinux/toolbox pkg:rpm/almalinux/toolbox-tests pkg:rpm/almalinux/udica pkg:rpm/opensuse/go1.19&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.19&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Tumbleweed pkg:rpm/suse/go1.19&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3
< 0.37.1-r0+ 79 more
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.19.9-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 1.20.4-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 1.19.9
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 46-1.module_el8.7.0+3344+5bcd850f
- (no CPE)range: < 2:2.1.4-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:2.205.0-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.3.0-4.el9
- (no CPE)range: < 2:1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 1.8.3-1.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.9-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 4.4.0-1.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 4.4.0-1.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.2.5-2.module_el8.8.0+3468+16b86c82
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.0.2-24.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 4.0.0-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 1.1.8-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.2.6-4.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-1.1
- (no CPE)range: < 1.20.4-150000.1.11.1
- (no CPE)range: < 1.20.4-1.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.19.9-150000.1.31.1
- (no CPE)range: < 1.20.4-150000.1.11.1
- (no CPE)range: < 1.20.4-150000.1.11.1
Go standard library/html/templatev5
Range: 0

Patches

Vulnerability mechanics

References

go.dev/cl/491617nvdPatch
go.dev/issue/59722nvdIssue TrackingPatch
pkg.go.dev/vuln/GO-2023-1753nvdVendor Advisory
groups.google.com/g/golang-announce/c/MEb0UyuSMsUnvdMailing ListRelease Notes
security.netapp.com/advisory/ntap-20241213-0005/nvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000