CVE-2023-24538: Backticks not treated as string delimiters in html/template
Summary
CVE-2023-24538: Backticks not treated as string delimiters in html/template. Affects stdlib across 2 version ranges.
< 1.19.8
>= 1.20.0-0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-24538 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The html/template package within the stdlib is used for generating HTML and other text-based templates. It allows developers to define templates with placeholders that can be dynamically filled with data. However, a vulnerability exists in the way the html/template package handles backticks (`) as string delimiters in Javascript template literals.
Vulnerability Detail
The vulnerability arises from the fact that the html/template package does not properly consider backticks as Javascript string delimiters and fails to escape them as expected. This can lead to the injection of arbitrary Javascript code into the Go template. As a result, an attacker could potentially execute malicious code within the context of the Go template, leading to various security risks such as cross-site scripting (XSS) attacks or unauthorized data access.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8go get stdlib@v1.19.8 -
>= 1.20.0-0, < 1.20.31.20.3go get stdlib@v1.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users who rely on the previous behavior and want to continue using Go versions prior to 1.19.8 or 1.20.3, a workaround is available. By setting the GODEBUG flag jstmpllitinterp=1, users can re-enable the previous behavior. However, it is important to note that this workaround comes with the caveat that backticks will now be escaped, which may affect the intended functionality of the templates. Therefore, this workaround should be used with caution.
Conclusion
In conclusion, the html/template package in Go is vulnerable to a code injection issue when backticks are used within Javascript template literals. To mitigate this vulnerability, users should update their Go installations to version 1.19.8 or 1.20.3, or later. Alternatively, users can enable the GODEBUG flag jstmpllitinterp=1 as a workaround, but this may impact the functionality of the templates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows for the injection of arbitrary Javascript code into Go templates, which can lead to security risks such as cross-site scripting (XSS) attacks or unauthorized data access.
Versions prior to 1.19.8 and 1.20.3 of Go are affected by this vulnerability.
To fix this vulnerability, update your Go installation to version 1.19.8 or 1.20.3, or later.
Yes, you can continue using older versions of Go by enabling the GODEBUG flag jstmpllitinterp=1. However, be aware that backticks will now be escaped, which may impact the functionality of your templates.
Yes, the workaround is to enable the GODEBUG flag jstmpllitinterp=1. However, use this workaround with caution as it may affect the intended behavior of your templates.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
