CVE-2023-24540

CriticalCVSS 9.8

Published: 11/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Summary

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Risk Assessment

This may lead to improper sanitization of templates and potential content injection in JavaScript contexts.

Recommendation

Update the Go template library to a version containing the fix.

Other vulnerabilities in Go template library

CVE-2023-24538Critical
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. With the fix, Template.Parse returns an Error when it encounters templates like this.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS