HIGH7.3

GO-2023-1753

Improper handling of empty HTML attributes in html/template

Quick fix

GO-2023-1753 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.19.9

Details

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.19.9

Fixgo get stdlib@v1.19.9

References

https://go.dev/issue/59722[REPORT]
https://go.dev/cl/491617[FIX]
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU[WEB]