FlawAtlas
Search the atlas
UBUNTU-CVE-2023-39319 Moderate

UBUNTU-CVE-2023-39319

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Exploit probability Not scored
Published September 8, 2023
Required by Not available
Last source change May 20, 2026

02 / AFFECTED SOFTWARE

Affected packages

Ubuntu:14.04:LTS golang-1.10

1 explicit affected versions

Ubuntu:16.04:LTS golang-1.10

2 explicit affected versions

Ubuntu:16.04:LTS golang-1.6

10 explicit affected versions

Ubuntu:18.04:LTS golang-1.10

8 explicit affected versions

Ubuntu:18.04:LTS golang-1.8

2 explicit affected versions

Ubuntu:18.04:LTS golang-1.9

5 explicit affected versions

Ubuntu:20.04:LTS golang-1.13

10 explicit affected versions

Ubuntu:20.04:LTS golang-1.14

9 explicit affected versions

Ubuntu:20.04:LTS golang-1.18

2 explicit affected versions

Ubuntu:20.04:LTS golang-1.20

1 explicit affected versions

Ubuntu:22.04:LTS golang-1.17

4 explicit affected versions

Ubuntu:22.04:LTS golang-1.18

7 explicit affected versions

Ubuntu:22.04:LTS golang-1.20

1 explicit affected versions

Ubuntu:Pro:16.04:LTS golang-1.13

4 explicit affected versions

Ubuntu:Pro:16.04:LTS golang-1.18

1 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.13

4 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.16

2 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.18

2 explicit affected versions

Ubuntu:Pro:20.04:LTS golang-1.16

3 explicit affected versions

Ubuntu:Pro:22.04:LTS golang-1.13

4 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities UBUNTU-CVE-2023-39319

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

View original source

05 / REFERENCES

Further evidence