html/template vulnerabilities
4 known vulnerabilities in html/template from Go standard library. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
- 9.8 Critical severity
html/template: Improper Neutralization of Special Elements used in a Command
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if
- 9.8 Critical severity
html/template: Improper Control of Generation of Code
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the