Vulnerability Report: GO-2024-2610
- CVE-2024-24785
- Affects: html/template
- Published: Mar 05, 2024
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
Affected Packages
-
PathVersionsSymbols
-
before go1.21.8, from go1.22.0-0 before go1.22.1
Aliases
References
- https://go.dev/issue/65697
- https://go.dev/cl/564196
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://vuln.go.dev/ID/GO-2024-2610.json
Credits
- RyotaK (https://ryotak.net)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.