VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 2, 2023· Updated Sep 27, 2024

Improper rendering of text nodes in golang.org/x/net/html

CVE-2023-3978

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Text nodes outside the HTML namespace are not escaped in Go's x/net/html, enabling stored XSS attacks.

Vulnerability

Overview

CVE-2023-3978 is a cross-site scripting (XSS) vulnerability in Go's x/net/html package. The bug occurs when the HTML parser encounters text nodes that are not within the HTML namespace (e.g., inside SVG or MathML elements). Instead of properly escaping the text content, the parser renders it literally, allowing unescaped HTML or JavaScript to be injected into the output [1][3].

Exploitation

An attacker can exploit this by crafting input that includes text nodes in a non-HTML namespace (such as `) containing malicious script payloads. When the x/net/html` package is used to parse and then render such input (e.g., in a web application that sanitizes or transforms user-supplied HTML), the unescaped text is emitted directly into the resulting HTML. No special authentication or network position is required beyond the ability to supply content that will be processed by the vulnerable parser [2].

Impact

Successful exploitation leads to stored XSS, where the attacker's script executes in the context of any user viewing the rendered output. This can result in session theft, credential harvesting, or arbitrary actions performed on behalf of the victim. The vulnerability is rated with a CVSS score that reflects the potential for significant confidentiality, integrity, and availability impact [1].

Mitigation

The Go team has fixed this issue in a subsequent release of the x/net module. Users should update to the patched version (e.g., via go get golang.org/x/net@latest). The fix ensures that text nodes outside the HTML namespace are properly escaped before rendering. No workaround is available; upgrading is the recommended action [2][3].

References
  1. NVD - CVE-2023-3978
  2. GO-2023-1988 - Go Packages
  3. x/net/html: text nodes outside of the HTML namespace improperly rendered

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.13.00.13.0

Affected products

982

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.