CVE-2023-39318: Improper handling of HTML-like comments in script contexts in html/template
Summary
CVE-2023-39318: Improper handling of HTML-like comments in script contexts in html/template. Affects stdlib across 2 version ranges.
< 1.20.8
>= 1.21.0-0, < 1.21.1
Fixed in 1.20.8 or 1.21.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-39318 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem includes the html/template package, which provides functionality for generating HTML output. The package allows developers to define templates with placeholders that can be filled with dynamic data. These templates can be rendered to produce HTML output. However, the html/template package has a vulnerability that affects the handling of HTML-like comments in script contexts. This vulnerability can lead to improper interpretation of the contents of <script> contexts, potentially resulting in actions being improperly escaped. This vulnerability can be exploited to perform cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the html/template package's improper handling of HTML-like "" comment tokens and hashbang "#!" comment tokens in <script> contexts. When these comment tokens are encountered, the template parser may misinterpret the contents of <script> contexts, causing actions to be improperly escaped. This can be leveraged by an attacker to inject malicious code into the generated HTML output, leading to XSS attacks. The vulnerability affects versions 0.0.0 to 1.20.8 and 1.21.0-0 to 1.21.1 of the stdlib package in the Go ecosystem.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.20.81.20.8go get stdlib@v1.20.8 -
>= 1.21.0-0, < 1.21.11.21.1go get stdlib@v1.21.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Go installation is not immediately feasible, developers can implement a workaround by manually escaping the contents of <script> contexts in their templates. This can be done by using the template's built-in escaping functions, such as html/template's EscapeString function. Here's an example of how to apply the workaround:
import (
"html/template"
"os"
)
func main() {
t := template.Must(template.New("example").Parse("<script>{{.}}</script>"))
data := "<alert>" // Data to be inserted into the template
t.Execute(os.Stdout, template.HTML(data))
}
Conclusion
The html/template package in the stdlib package of the Go ecosystem has a vulnerability that allows for improper handling of HTML-like comments in script contexts. This can lead to actions being improperly escaped and potential XSS attacks. Developers should update their Go installation to versions 1.20.8 or 1.21.1 of the stdlib package to fix this vulnerability. Alternatively, a workaround can be implemented by manually escaping the contents of <script> contexts in templates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows an attacker to inject malicious code into the generated HTML output, potentially leading to cross-site scripting (XSS) attacks. This can result in the execution of arbitrary code in the context of the victim's browser, compromising the confidentiality and integrity of user data.
The vulnerability affects versions 0.0.0 to 1.20.8 and 1.21.0-0 to 1.21.1 of the stdlib package in the Go ecosystem.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities in real-time.
Yes, the vulnerability has been fixed in versions 1.20.8 and 1.21.1 of the stdlib package. Developers should update their Go installation to a version that includes the fix.
Yes, if updating the Go installation is not immediately feasible, developers can manually escape the contents of <script> contexts in their templates using the template's built-in escaping functions.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
