GO-2023-1988

Improper rendering of text nodes in golang.org/x/net/html

En bref

Publiée: 2023-08-02 15:06 UTC
Mise à jour: 2026-02-04 04:12 UTC
CVE: CVE-2023-3978
Alias: GHSA-2wrh-6pvc-2jm9

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Paquets affectés

Paquet	Versions
Go · golang.org/x/net	introduced 0, fixed 0.13.0

Références

https://go.dev/issue/61615 REPORT
https://go.dev/cl/514896 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database