Improper rendering of text nodes in golang.org/x/net/html

MITTEL 6.1CVE-2023-3978 · GHSA-2wrh-6pvc-2jm9 · GO-2023-1988 · Published 02/08/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-3978 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in golang.org/x/net, networking (golang).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.85%, höher als bei 58.2% aller Schwachstellen.
Abhilfe: auf 0.13.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
golang.org/x/net Go	`< 0.13.0`	`0.13.0`
networking golang	`< 0.13.0`	`0.13.0`

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

NVD description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

References

nvd.nist.gov/vuln/detail/CVE-2023-3978 · ADVISORY
go.dev/cl/514896 · WEB
go.dev/issue/61615 · WEB
pkg.go.dev/vuln/GO-2023-1988 · WEB

Weitere Schwachstellen in golang.org/x/net

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

golang.org/x/net

< 0.13.0

0.13.0

networking

golang

< 0.13.0

0.13.0

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

NVD description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Weitere Schwachstellen in golang.org/x/net

Alle anzeigen →