The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Related CVEs

CVE-2023-39319

Key Information

GHSA ID

GHSA-vv9m-32rr-3g55

Published

September 8, 2023 6:30 PM

Last Modified

November 2, 2023 3:30 AM

CVSS Score

5.0 /10

Primary Ecosystem

Unknown

Primary Package

Unknown

GitHub Reviewed

✗ No

Dataset

Last updated: July 17, 2025 2:40 PM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.