CVE-2023-29400

Improper handling of empty HTML attributes in html/template

Published May 11, 2023 CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Description
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-32972 Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
Ubuntu USN Ubuntu USN USN-6140-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00048}

epss

{'score': 0.00049}

Type Values Removed Values Added
Weaknesses CWE-94
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}