CVE-2024-24785
Assigner: Go
Published: 2024-03-05T22:22:33.640Z
State: PUBLISHED
title: Errors returned from JSON marshaling may break template escaping in html/template
descriptions: value: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
affected: vendor: Go standard library
product: html/template
collectionURL: https://pkg.go.dev
packageName: html/template
versions: version: 0
lessThan: 1.21.8
status: affected
versionType: semver
version: 1.22.0-0
lessThan: 1.22.1
status: affected
versionType: semver
programRoutines: jsValEscaper
escaper.commit
Template.Execute
Template.ExecuteTemplate
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
credits: value: RyotaK (https://ryotak.net)