CVE-2024-24785: Go Standard Library Html/template

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Affected products

• Go Standard Library Html/template: before 1.21.8 (fixed in 1.21.8); from 1.22.0-0, before 1.22.1 (fixed in 1.22.1)

Published 2024-03-05. Last modified 2026-06-17.