CVEvulnerability
CVE-2023-24540
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-05-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77
Description
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
Affected configurations
• golang go (< 1.19.9)
• golang go (>= 1.20.0 < 1.20.4)
Related
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- https://go.dev/cl/491616 Patch
- https://go.dev/issue/59721 Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU Mailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1752 Vendor Advisory
- https://go.dev/cl/491616 Patch
- https://go.dev/issue/59721 Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU Mailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2023-1752 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241115-0008/ security.netapp.com