1. Home
  2. Security Advisories
  3. Go
  4. GO-2024-2610

[GO-2024-2610] Errors returned from JSON marshaling may break template escaping in html/template

Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages Vulnerabilities

If errors returned from MarshalJSON methods contain user controlled data, they
may be used to break the contextual auto-escaping behavior of the html/template
package, allowing for subsequent actions to inject unexpected content into
templates.

Package Affected Version
pkg:golang/html/template >= 1.22.0, < 1.21.8
pkg:golang/html/template >= 1.22.0, < 1.22.1
Package Fixed Version
pkg:golang/html/template = 1.21.8
pkg:golang/html/template = 1.22.1
ID
GO-2024-2610
URL
https://pkg.go.dev/vuln/GO-2024-2610
Published
2024-03-05T21:34:20
(6 months ago)
Modified
2024-07-17T19:54:18
(2 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/html/template html template = 1.21.8
Affected pkg:golang/html/template html template >= 1.22.0 < 1.21.8
Fixed pkg:golang/html/template html template = 1.22.1
Affected pkg:golang/html/template html template >= 1.22.0 < 1.22.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date