UNKNOWN Go
Improper handling of empty HTML attributes in html/template
GO-2023-1753 · BIT-golang-2023-29400 · CVE-2023-29400
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes