CVE-2023-29400

Improper handling of empty HTML attributes in html/template

High · published May 11, 2023

CVSS v3.1
7.3
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01037 · 63.6th percentile
Published
2023-05-11T15:29Z
EPSS history
Timeline
  • 11 MAY 15:29Z
    Improper handling of empty HTML attributes in html/template
    cvelistv5