MEDIUM6.1

GHSA-2wrh-6pvc-2jm9

Improper rendering of text nodes in golang.org/x/net/html

Quick fix

GHSA-2wrh-6pvc-2jm9 — golang.org/x/net: upgrade to the fixed version with the command below.

go get golang.org/x/net@v0.13.0

Details

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/golang.org/x/net

Introduced in: 0Fixed in: 0.13.0

Fixgo get golang.org/x/net@v0.13.0

References

https://nvd.nist.gov/vuln/detail/CVE-2023-3978[ADVISORY]
https://go.dev/cl/514896[WEB]
https://go.dev/issue/61615[WEB]
https://pkg.go.dev/vuln/GO-2023-1988[WEB]