CVE-2023-39319: Improper handling of special tags within script contexts in html/template
Summary
CVE-2023-39319: Improper handling of special tags within script contexts in html/template. Affects stdlib across 2 version ranges.
< 1.20.8
>= 1.21.0-0, < 1.21.1
Fixed in 1.20.8 or 1.21.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-39319 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The html/template package is a part of the Go standard library and is used for generating HTML output. It provides a way to define templates that can be dynamically filled with data. The package includes functions for executing templates and escaping special characters to prevent cross-site scripting (XSS) attacks. However, a vulnerability exists in the package's handling of special tags within script contexts, which can lead to improper escaping and potential XSS attacks.
Vulnerability Detail
The vulnerability in the html/template package arises from the improper handling of occurrences of "<script", "<!--", and "</script" within JavaScript literals in <script> contexts. The template parser does not apply the proper rules for recognizing and terminating script contexts, leading to actions being improperly escaped. This can be exploited by an attacker to inject malicious scripts and perform XSS attacks. The impact of an XSS attack can range from stealing sensitive user information to modifying the content of a web page.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.20.81.20.8go get stdlib@v1.20.8 -
>= 1.21.0-0, < 1.21.11.21.1go get stdlib@v1.21.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Go version is not immediately feasible, a temporary workaround is to manually sanitize and escape any user-generated content that is being inserted into the template. This can be done using the appropriate escaping functions provided by the html/template package, such as template.HTMLEscapeString or template.JSEscapeString. By properly escaping the content, the risk of XSS attacks can be mitigated. Here is an example of how to use template.HTMLEscapeString to sanitize user input:
import (
"html/template"
"net/http"
)
func handler(w http.ResponseWriter, r *http.Request) {
userInput := r.FormValue("input")
sanitizedInput := template.HTMLEscapeString(userInput)
// Use the sanitizedInput in the template
}
Conclusion
The html/template package in Go is vulnerable to improper handling of special tags within script contexts, which can lead to cross-site scripting (XSS) attacks. It is crucial to update the affected Go version to at least 1.20.8 or 1.21.1 to fix this vulnerability. If immediate updating is not possible, manual sanitization and escaping of user-generated content can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows an attacker to inject malicious scripts into a web application, potentially leading to cross-site scripting (XSS) attacks. This can result in the theft of sensitive user information, unauthorized actions on behalf of the user, or modification of the web page's content.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your application's dependencies without requiring access to the code or installation. Simply provide your Gopkg.lock file, and Vulert will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
Yes, a fix is available for this vulnerability. It is recommended to update the affected Go version to at least 1.20.8 or 1.21.1, depending on the specific version being used. These versions include the necessary fixes to properly handle special tags within script contexts and prevent the vulnerability from being exploited.
If updating the Go version is not immediately feasible, a temporary workaround is to manually sanitize and escape any user-generated content that is being inserted into the template. This can be done using the appropriate escaping functions provided by the html/template package, such as template.HTMLEscapeString or template.JSEscapeString. By properly escaping the content, the risk of XSS attacks can be mitigated.
This vulnerability was discovered by Takeshi Kaneko from GMO Cybersecurity by Ierae, Inc.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
