Errors returned from JSON marshaling may break template escaping in html/template

CVE-2024-24785

What is CVE-2024-24785?

This vulnerability arises when user-controlled data is included in errors returned by MarshalJSON methods. Such scenarios disrupt the auto-escaping mechanism of Go's html/template package, making it possible for an attacker to exploit this flaw and inject unintended content into templates. The implications of this vulnerability may affect the integrity and confidentiality of applications utilizing the affected versions of the Go programming language.

References