GHSA-2wrh-6pvc-2jm9

Improper rendering of text nodes in golang.org/x/net/html

En bref

Publiée: 2023-08-02 21:30 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2023-3978
Alias: GO-2023-1988
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Paquets affectés

Paquet	Versions
Go · golang.org/x/net	introduced 0, fixed 0.13.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2023-3978 ADVISORY
https://go.dev/cl/514896 WEB
https://go.dev/issue/61615 WEB
https://pkg.go.dev/vuln/GO-2023-1988 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database