CVE-2023-3978 | BDVDB-2026-208476 Detail

golang.org/x/netgolang.org/x/net/html

Description#

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://go.dev/issue/61615
https://go.dev/cl/514896
https://pkg.go.dev/vuln/GO-2023-1988

Exploit#

No public exploit known

History#

Version 12023-08-02Record published in the CVE List.
Version 22024-09-27Most recent update recorded in the CVE List.