6.1

CVE-2023-39318: Improper handling of HTML-like comments in script contexts in html/template

Modified
AliasesUBUNTU-CVE-2023-39318DEBIAN-CVE-2023-39318CGA-2944-x86v-qw72
Published 08-09-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-39318 is a medium (CVSS 6.1) vulnerability in go standard library html/template. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
0.93%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 24 · Related 14
OPENSUSE-SU-2023:0360-1OPENSUSE-SU-2024:13216-1OPENSUSE-SU-2024:13217-1RHBA-2023:6364RHBA-2023:6928RHSA-2023:5008

Timeline

  1. 08-09-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.93%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.93% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard12 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
  • katib-suggestion-nas-darts< 0.19.0-r31
Wolfi12 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
  • katib-suggestion-nas-darts< 0.19.0-r31
Ubuntu10 products
  • golang-1.10All versions (No fix recorded)
  • golang-1.13All versions (No fix recorded)
  • golang-1.14All versions (No fix recorded)
  • golang-1.16All versions (No fix recorded)
  • golang-1.17< 1.17.13-3ubuntu1.2
Alpine1 product
  • go≥ 1.21.0, < 1.20.8-r0 | ≥ 1.21.0, < 1.21.1-r0
Debian1 product
  • golang-1.19All versions (No fix recorded)
Go1 product
  • stdlib≥ 1.21.0-0, < 1.21.1
Go standard library1 product
Golang1 product
  • go< 1.20.8 | ≥ 1.21.0, < 1.21.1

8 vendors · 39 products

References

17 links
Show all 17 references