CVE-2023-29400: Golang Go

High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days.

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Affected products

• Golang Go: before 1.19.9 (fixed in 1.19.9); from 1.20.0, before 1.20.4 (fixed in 1.20.4)

Published 2023-05-11. Last modified 2026-06-17.