Backticks not treated as string delimiters in html/template

CVE-2023-24538

What is CVE-2023-24538?

The vulnerability arises from the improper handling of backticks (`) within JavaScript template literals in Go templates. This oversight allows for the termination of literals, potentially facilitating the injection of arbitrary JavaScript code through the contents of Go template actions. Due to the complexity of ES6 template literals, the Go programming team made the decision to disallow the use of Go template actions within them, as there is no safe way to permit this functionality. With the release of Go 1.21, a fix is introduced where parsing such templates will return an error, effectively mitigating this risk. However, users wishing to maintain previous behavior can use the GODEBUG flag, but must do so with caution due to potential security implications.

References