Medium severity6.1NVD Advisory· Published Sep 8, 2023· Updated Jun 17, 2026

CVE-2023-39318

Description

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Golang/Go
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Range: <1.20.8
Golang/html/templatellm-create
osv-coords89 versions
pkg:apk/chainguard/falco pkg:apk/chainguard/falco-dev pkg:apk/chainguard/falco-src pkg:apk/chainguard/katib-earlystopping pkg:apk/chainguard/katib-suggestion-hyperband pkg:apk/chainguard/katib-suggestion-hyperopt pkg:apk/chainguard/katib-suggestion-nas-darts pkg:apk/chainguard/katib-suggestion-nas-enas pkg:apk/chainguard/katib-suggestion-optuna-enas pkg:apk/chainguard/katib-suggestion-pbt-enas pkg:apk/chainguard/katib-suggestion-skopt-enas pkg:apk/chainguard/katib-tfevent-metricscollector pkg:apk/chainguard/kind pkg:apk/chainguard/metrics-server pkg:apk/chainguard/metrics-server-bitnami-compat pkg:apk/chainguard/metrics-server-compat pkg:apk/chainguard/metrics-server-iamguarded-compat pkg:apk/wolfi/falco pkg:apk/wolfi/falco-dev pkg:apk/wolfi/falco-src pkg:apk/wolfi/katib-earlystopping pkg:apk/wolfi/katib-suggestion-hyperband pkg:apk/wolfi/katib-suggestion-hyperopt pkg:apk/wolfi/katib-suggestion-nas-darts pkg:apk/wolfi/katib-suggestion-nas-enas pkg:apk/wolfi/katib-suggestion-optuna-enas pkg:apk/wolfi/katib-suggestion-pbt-enas pkg:apk/wolfi/katib-suggestion-skopt-enas pkg:apk/wolfi/katib-tfevent-metricscollector pkg:apk/wolfi/kind pkg:apk/wolfi/metrics-server pkg:apk/wolfi/metrics-server-bitnami-compat pkg:apk/wolfi/metrics-server-compat pkg:apk/wolfi/metrics-server-iamguarded-compat pkg:bitnami/golang pkg:rpm/almalinux/aardvark-dns pkg:rpm/almalinux/buildah pkg:rpm/almalinux/buildah-tests pkg:rpm/almalinux/cockpit-podman pkg:rpm/almalinux/conmon pkg:rpm/almalinux/container-selinux pkg:rpm/almalinux/containernetworking-plugins pkg:rpm/almalinux/containers-common pkg:rpm/almalinux/crit pkg:rpm/almalinux/criu pkg:rpm/almalinux/criu-devel pkg:rpm/almalinux/criu-libs pkg:rpm/almalinux/crun pkg:rpm/almalinux/fuse-overlayfs pkg:rpm/almalinux/libslirp pkg:rpm/almalinux/libslirp-devel pkg:rpm/almalinux/netavark pkg:rpm/almalinux/oci-seccomp-bpf-hook pkg:rpm/almalinux/podman pkg:rpm/almalinux/podman-catatonit pkg:rpm/almalinux/podman-docker pkg:rpm/almalinux/podman-gvproxy pkg:rpm/almalinux/podman-plugins pkg:rpm/almalinux/podman-remote pkg:rpm/almalinux/podman-tests pkg:rpm/almalinux/python3-criu pkg:rpm/almalinux/python3-podman pkg:rpm/almalinux/runc pkg:rpm/almalinux/skopeo pkg:rpm/almalinux/skopeo-tests pkg:rpm/almalinux/slirp4netns pkg:rpm/almalinux/toolbox pkg:rpm/almalinux/toolbox-tests pkg:rpm/almalinux/udica pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.20-openssl&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20-openssl&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.21&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.21&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.21&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.21-openssl&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.21-openssl&distro=openSUSE%20Leap%2015.5 pkg:rpm/suse/go&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.21&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.21&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.21&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/go1.21-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.21-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5
< 0.37.1-r0+ 88 more
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.21.0-r0
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.21.0-r0
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 0.6.4-r1
- (no CPE)range: < 1.20.8
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.31.3-2.el9_3
- (no CPE)range: < 1:1.31.3-2.el9_3
- (no CPE)range: < 46-1.module_el8.7.0+3344+5bcd850f
- (no CPE)range: < 2:2.1.4-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:2.205.0-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.3.0-6.el9_3
- (no CPE)range: < 2:1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 1.8.7-1.module_el8.9.0+3683+33eb0feb
- (no CPE)range: < 1.9-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 4.4.0-1.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 4.4.0-1.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.2.5-2.module_el8.8.0+3468+16b86c82
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 2:4.6.1-7.el9_3
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 4.0.0-2.module_el8.9.0+3711+04fcca5e
- (no CPE)range: < 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:1.13.3-3.el9_3
- (no CPE)range: < 2:1.13.3-3.el9_3
- (no CPE)range: < 1.1.8-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.0.99.4-5.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.0.99.4-5.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.2.6-4.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.20.8-150000.1.23.1
- (no CPE)range: < 1.20.8-150000.1.23.1
- (no CPE)range: < 1.20.8-1.1
- (no CPE)range: < 1.20.8.1-150000.1.11.1
- (no CPE)range: < 1.20.8.1-150000.1.11.1
- (no CPE)range: < 1.21.1-150000.1.6.1
- (no CPE)range: < 1.21.1-150000.1.6.1
- (no CPE)range: < 1.21.1-1.1
- (no CPE)range: < 1.21.4.1-150000.1.5.1
- (no CPE)range: < 1.21.4.1-150000.1.5.1
- (no CPE)range: < 1.21-41.1
- (no CPE)range: < 1.20.8-150000.1.23.1
- (no CPE)range: < 1.20.8-150000.1.23.1
- (no CPE)range: < 1.20.8.1-150000.1.11.1
- (no CPE)range: < 1.20.8.1-150000.1.11.1
- (no CPE)range: < 1.21.1-150000.1.6.1
- (no CPE)range: < 1.21.1-150000.1.6.1
- (no CPE)range: < 1.21.3-2.1
- (no CPE)range: < 1.21.4.1-150000.1.5.1
- (no CPE)range: < 1.21.4.1-150000.1.5.1
Go standard library/html/templatev5
Range: 0

Patches

Vulnerability mechanics

References

go.dev/cl/526156nvdPatch
pkg.go.dev/vuln/GO-2023-2041nvdVendor Advisory
security.netapp.com/advisory/ntap-20231020-0009/nvdThird Party Advisory
go.dev/issue/62196nvdIssue Tracking
groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJnvdMailing ListRelease Notes
security.gentoo.org/glsa/202311-09nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000