Agent 2 package are built with Go version affected by CVE-2023-24538

CVE-2023-29453

What is CVE-2023-29453?

A vulnerability exists in Zabbix Server that improperly handles backticks in JavaScript template literals, which can lead to JavaScript code injection through unintended template actions. This flaw emerges when Go template actions are embedded within JavaScript, enabling attackers to manipulate script execution. With the release of Go 1.21 and the implementation of protective measures, such injections are prevented by returning an error when such templates are detected. Users are advised to review their configurations, especially if they previously relied on the behavior that allowed these actions, as it can be restored via specific debugging flags with caution.

References