CVE-2023-39318: Golang Go

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Affected products

• Golang Go: before 1.20.8 (fixed in 1.20.8); from 1.21.0, before 1.21.1 (fixed in 1.21.1)

Published 2023-09-08. Last modified 2026-06-17.