GO-2023-1988

Improper rendering of text nodes in golang.org/x/net/html

At a glance

Published: 2023-08-02 15:06 UTC
Updated: 2026-02-04 04:12 UTC
CVE: CVE-2023-3978
Aliases: GHSA-2wrh-6pvc-2jm9

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Affected packages

Package	Versions
Go · golang.org/x/net	introduced 0, fixed 0.13.0

References

https://go.dev/issue/61615 REPORT
https://go.dev/cl/514896 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database