CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

View on CVE.org
Published May 11, 2023 CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Description
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-28556 Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Ubuntu USN Ubuntu USN USN-6140-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00243}

 epss

{'score': 0.0025}
Type Values Removed Values Added
Weaknesses CWE-77
Type Values Removed Values Added
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Jan 24, 2025, 4:45 PM
Reserved
Jan 25, 2023, 9:19 PM

View source JSON

Updated
Nov 15, 2024, 1:08 PM

JSON

Status
Modified
Published
May 11, 2023, 4:15 PM
Modified
Jun 17, 2026, 5:39 AM

View source JSON

Severity
Important
Public date
Apr 20, 2023, 12:00 AM

View source Bugzilla JSON

No data.