Read the docs
TI-2023-10161 Aliases CVE-2023-24540GHSA-7qhm-5mxq-x7vp

Improper handling of JavaScript whitespace in html/template

Priority MEDIUM 52CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 27 fixed, 20 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-77.

Summary

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0156 75th percentileScored 2026-11-07
Fix Partial html/template (Go standard library): 1.19.9, 1.20.4Red Hat: 38 advisoriesRed Hat: 27 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard libraryhtml/templatebefore 1.19.9; 1.20.0-0 to before 1.20.41.19.9, 1.20.4Patch availableCNA
  • html/template VendorGo standard library Affected before 1.19.9; 1.20.0-0 to before 1.20.4 Fixed in 1.19.9, 1.20.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.19.9; 1.20.0 to before 1.20.4VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.9; 1.20.0 to before 1.20.4 Vulnerable ·Go standard library

Remediation

  • Fix · CNA html/template (Go standard library) Fixed in 1.19.9, 1.20.4

Red Hat 38 advisories

  • RHSA-2024:4119 Released 2024-06-26 · Red Hat rating Important
    Updated rhceph-5.3 container image and security update
    • Red Hat Ceph Storage 5.3 Tools rhceph/keepalived-rhel8, rhceph/rhceph-5-dashboard-rhel8, rhceph/rhceph-5-rhel8 +2
  • RHSA-2024:2944 Released 2024-05-21 · Red Hat rating Important
    AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
    • Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
  • RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
Show 35 more Red Hat advisories
  • RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
  • RHSA-2023:6346 Released 2023-11-07 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.4-6.el9_3, toolbox-tests-0.0.99.4-6.el9_3
  • RHSA-2023:6402 Released 2023-11-07 · Red Hat rating Moderate
    containernetworking-plugins security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-4.el9
  • RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderate
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
  • RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
  • RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
  • RHSA-2023:5947 Released 2023-10-26 · Red Hat rating Important
    Run Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update
    • RODOO 1.0 for RHEL 8 run-once-duration-override-operator/run-once-duration-override-rhel8
  • RHSA-2023:5376 Released 2023-09-27 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.3 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/odf-console-rhel9
  • RHSA-2023:4664 Released 2023-08-16 · Red Hat rating Important
    OpenShift Virtualization 4.13.3 Images security and bug fix update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:4627 Released 2023-08-14 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
  • RHSA-2023:4470 Released 2023-08-03 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
  • RHSA-2023:4421 Released 2023-08-01 · Red Hat rating Important
    OpenShift Virtualization 4.12.5 security and bug fix update
    • CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40
  • RHSA-2023:4420 Released 2023-08-01 · Red Hat rating Important
    OpenShift Virtualization 4.12.5 RPMs security and bug fix update
    • CNV 4.12 for RHEL 7 kubevirt-4.12.5-1189.el7, kubevirt-virtctl-4.12.5-1189.el7, kubevirt-virtctl-redistributable-4.12.5-1189.el7
    • CNV 4.12 for RHEL 8 kubevirt-4.12.5-1189.el8, kubevirt-virtctl-4.12.5-1189.el8, kubevirt-virtctl-redistributable-4.12.5-1189.el8
  • RHSA-2023:4289 Released 2023-07-27 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.0.11 security and bug fix update
    • 8Base-OADP-1.0 oadp/oadp-velero-rhel8
  • RHSA-2023:3910 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.10 containers-common-1:1.2.4-1.1.el8, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el8 +10
  • RHSA-2023:3914 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
  • RHSA-2023:3911 Released 2023-07-06 · Red Hat rating Important
    OpenShift Container Platform 4.10.63 security update
    • Red Hat OpenShift Container Platform 4.10 openshift-tech-preview/metallb-rhel8, openshift4/bare-metal-event-relay-rhel8-operator, openshift4/baremetal-hardware-event-proxy-rhel8 +47
  • RHSA-2023:3915 Released 2023-07-06 · Red Hat rating Important
    OpenShift Container Platform 4.11.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift-tech-preview/metallb-rhel8, openshift4/cloud-event-proxy-rhel8, openshift4/cloud-network-config-controller-rhel8 +47
  • RHSA-2023:3918 Released 2023-06-29 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-rhel8
  • RHSA-2023:3905 Released 2023-06-28 · Red Hat rating Important
    Network observability 1.3.0 for Openshift
    • NETOBSERV 1.3 for RHEL 9 network-observability/network-observability-rhel9-operator
  • RHSA-2023:3612 Released 2023-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.4 packages and security update
    • Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
  • RHSA-2023:3644 Released 2023-06-15 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.4.0
    • RHOSSM 2.4 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +2
  • RHSA-2023:3624 Released 2023-06-15 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.10 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-velero-plugin-rhel8
  • RHSA-2023:3545 Released 2023-06-14 · Red Hat rating Important
    OpenShift Container Platform 4.12.21 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 python-flask-1:2.0.1-3.el9, python-flask-doc-1:2.0.1-3.el9, python3-flask-1:2.0.1-3.el9
    • Red Hat OpenShift Container Platform 4.12 podman-3:4.2.0-4.1.rhaos4.12.el8, podman-catatonit-3:4.2.0-4.1.rhaos4.12.el8, podman-docker-3:4.2.0-4.1.rhaos4.12.el8 +4
  • RHSA-2023:3409 Released 2023-06-07 · Red Hat rating Important
    OpenShift Container Platform 4.12.20 packages and security update
    • Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-4.1.rhaos4.12.el8, buildah-tests-1:1.23.4-4.1.rhaos4.12.el8, openshift-4.12.0-202305301919.p0.g3fe2906.assembly.stream.el8 +9
  • RHSA-2023:3410 Released 2023-06-07 · Red Hat rating Important
    OpenShift Container Platform 4.12.20 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:3366 Released 2023-06-07 · Red Hat rating Important
    OpenShift Container Platform 4.13.2 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common-1:21.3.1-0.20230510075528.b3c902e.el9 +3
    • Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.16.1.el9_2, buildah-1:1.29.1-1.1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.1.rhaos4.13.el9 +47
  • RHSA-2023:3367 Released 2023-06-07 · Red Hat rating Important
    OpenShift Container Platform 4.13.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:3445 Released 2023-06-05 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-14.el8ost
  • RHSA-2023:3435 Released 2023-06-05 · Red Hat rating Important
    Red Hat Advanced Cluster Security 3.74 for Kubernetes security update
    • RHACS 3.74 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2023:3415 Released 2023-05-31 · Red Hat rating Important
    ACS 4.0 enhancement and security update
    • RHACS 4.0 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2023:3379 Released 2023-05-31 · Red Hat rating Important
    Red Hat Advanced Cluster Security for Kubernetes 3.73 security update
    • RHACS 3.73 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2023:3323 Released 2023-05-25 · Red Hat rating Important
    go-toolset-1.19 and go-toolset-1.19-golang security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
  • RHSA-2023:3319 Released 2023-05-25 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.9-1.module+el8.8.0+18857+fca43658.aarch64::go-toolset:rhel8 +18
  • RHSA-2023:3318 Released 2023-05-25 · Red Hat rating Important
    go-toolset and golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) golang-1.19.9-2.el9_2, golang-bin-1.19.9-2.el9_2, golang-docs-1.19.9-2.el9_2 +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Go standard library html/template 1.19.9, 1.20.4

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-13780 Improper handling of empty HTML attributes in html/templatePriority LOW 34
    • TI-2023-10160 Improper sanitization of CSS values in html/templatePriority LOW 34
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet
8Base-OADP-1.0Fixed RHSA-2023:4289
8Base-OADP-1.1Fixed RHSA-2023:3918
8Base-RHMTC-1.7Fixed RHSA-2023:3624
CNV 4.12 for RHEL 7Fixed RHSA-2023:4420
CNV 4.12 for RHEL 8Fixed RHSA-2023:4420, RHSA-2023:4421
CNV 4.13 for RHEL 9Fixed RHSA-2023:4664
MTA 6.2 for RHEL 8Fixed RHSA-2023:4627
Middleware Containers for OpenShiftFixed RHSA-2024:2944
NETOBSERV 1.3 for RHEL 9Fixed RHSA-2023:3905
Quay v3Fixed—
RHACS 3.73 for RHEL 8Fixed RHSA-2023:3379
RHACS 3.74 for RHEL 8Fixed RHSA-2023:3435
RHACS 4.0 for RHEL 8Fixed RHSA-2023:3415
RHODF 4.13 for RHEL 9Fixed RHSA-2023:5376
RHOSSM 2.4 for RHEL 8Fixed RHSA-2023:3644
RODOO 1.0 for RHEL 8Fixed RHSA-2023:5947
Red Hat Ansible Automation Platform 2.3 for RHEL 8Fixed RHSA-2023:4470
Red Hat Ceph Storage 5.3 ToolsFixed RHSA-2024:4119
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:3323
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:3323
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:3319, RHSA-2023:6938, RHSA-2023:6939
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:3318, RHSA-2023:6346, RHSA-2023:6363, RHSA-2023:6402, RHSA-2023:6473, RHSA-2023:6474
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:3910, RHSA-2023:3911
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:3914, RHSA-2023:3915
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:3409, RHSA-2023:3410, RHSA-2023:3545
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:3366, RHSA-2023:3367, RHSA-2023:3612
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:3445
Not affected: 31 products
  • 8Base-OADP-1.0
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • Ironic content for Red Hat OpenShift Container Platform 4.12
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Logging Subsystem for Red Hat OpenShift
  • MTA 6.2 for RHEL 8
  • Middleware Containers for OpenShift
  • NETOBSERV 1.3 for RHEL 9
  • OpenShift Pipelines
  • OpenShift Secondary Scheduler Operator
  • RHACS 3.73 for RHEL 8
  • RHACS 3.74 for RHEL 8
  • RHACS 4.0 for RHEL 8
  • RHODF 4.13 for RHEL 9
  • RHOSSM 2.4 for RHEL 8
  • RODOO 1.0 for RHEL 8
  • Red Hat Application Interconnect 1.0
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift GitOps
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24540
  2. 2026-10-03 Alias added: GHSA-7qhm-5mxq-x7vp

References

Patch 2

Advisory 1

Other 1

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences