Improper handling of special tags within script contexts in html/template
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 15 fixed, 28 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00911 60th percentileScored 2026-11-07
Fix Partial html/template (Go standard library): 1.20.8, 1.21.1Red Hat: 22 advisoriesRed Hat: 15 fixed, 28 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | html/template | before 1.20.8; 1.21.0-0 to before 1.21.1 | 1.20.8, 1.21.1 | Patch available | CNA |
- html/template VendorGo standard library Affected before 1.20.8; 1.21.0-0 to before 1.21.1 Fixed in 1.20.8, 1.21.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.20.8; 1.21.0 to before 1.21.1 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.20.8; 1.21.0 to before 1.21.1 Vulnerable ·Go standard library
Remediation
- Fix · CNA html/template (Go standard library) Fixed in 1.20.8, 1.21.1
Red Hat 22 advisories
- RHSA-2024:3467 Released 2024-05-29 · Red Hat rating ImportantRed Hat OpenStack Platform 16.1 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-16.el8ost
- RHSA-2024:3352 Released 2024-05-23 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-16.el8ost
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
Show 19 more Red Hat advisories
- RHSA-2024:2160 Released 2024-04-30 · Red Hat rating Moderatetoolbox security update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-2.el9, toolbox-tests-0.0.99.5-2.el9
- RHSA-2024:1901 Released 2024-04-18 · Red Hat rating ModerateRed Hat Service Interconnect 1.5.3 Release (images)
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-rhel9, service-interconnect/skupper-flow-collector-rhel9 +4
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
- RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderatecontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
- RHSA-2023:7762 Released 2023-12-12 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-3.el9_3, skopeo-tests-2:1.13.3-3.el9_3
- RHSA-2023:7764 Released 2023-12-12 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-2.el9_3, buildah-tests-1:1.31.3-2.el9_3
- RHSA-2023:7766 Released 2023-12-12 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-6.el9_3
- RHSA-2023:7765 Released 2023-12-12 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-7.el9_3, podman-docker-2:4.6.1-7.el9_3, podman-gvproxy-2:4.6.1-7.el9_3 +3
- RHSA-2023:6840 Released 2023-11-15 · Red Hat rating ImportantOpenShift Container Platform 4.14.2 packages and security update
- Red Hat OpenShift Container Platform 4.14 cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el8, cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el9, openshift-clients-4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el8 +3
- RHSA-2023:6154 Released 2023-11-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.2.0
- OSSO 1.2 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:5008 Released 2023-10-31 · Red Hat rating ImportantRed Hat build of MicroShift 4.14.0 security update
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 +1
- RHSA-2023:5009 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
- Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
- RHSA-2023:6202 Released 2023-10-30 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.6.8 security and bug fix updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
- RHSA-2023:6200 Released 2023-10-30 · Red Hat rating ImportantMulticluster Engine for Kubernetes 2.1.9 security updates and bug fixes
- multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
- RHSA-2023:6161 Released 2023-10-30 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.14 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
- RHSA-2023:5947 Released 2023-10-26 · Red Hat rating ImportantRun Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update
- RODOO 1.0 for RHEL 8 run-once-duration-override-operator/run-once-duration-override-rhel8
- RHSA-2023:6115 Released 2023-10-25 · Red Hat rating ImportantOpenShift API for Data Protection security update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-for-aws-rhel8 +6
- RHSA-2023:6085 Released 2023-10-24 · Red Hat rating ImportantRed Hat OpenShift distributed tracing security update
- Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
- RHSA-2023:5974 Released 2023-10-20 · Red Hat rating ImportantNetwork Observability security update
- NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library html/template 1.20.8, 1.21.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-20460 Improper handling of HTML-like comments in script contexts in html/templatePriority LOW 29
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management Metrics Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | — |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | — |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Self Node Remediation Operator | Affected | No fix yet |
| 8Base-MTV-2.5 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:6115 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:6161 |
| LVMS 4.14 for RHEL 9 | Fixed | — |
| NETOBSERV 1.4 for RHEL 9 | Fixed | RHSA-2023:5974 |
| OSSO 1.2 for RHEL 8 | Fixed | RHSA-2023:6154 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
| RODOO 1.0 for RHEL 8 | Fixed | RHSA-2023:5947 |
| Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2023:6202 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0121, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:7762, RHSA-2023:7764, RHSA-2023:7765, RHSA-2023:7766, RHSA-2024:2160 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5008, RHSA-2023:5009, RHSA-2023:6840 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2024:3467 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:3352 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:1901 |
Not affected: 15 products
- 8Base-MTV-2.5
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- Ironic content for Red Hat OpenShift Container Platform 4.14
- Logging Subsystem for Red Hat OpenShift
- NETOBSERV 1.4 for RHEL 9
- RHODF 4.15 for RHEL 9
- RODOO 1.0 for RHEL 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenStack Platform 18.0
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39319
- 2026-10-03 Alias added: GHSA-vv9m-32rr-3g55
- 2026-10-16 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 · Red Hat
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-39319 · CVE Program
- CVE-2023-39319 · NVD
- FIRST EPSS
- GHSA-vv9m-32rr-3g55 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-39319 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences