CVE-2023-24540

critical

Description

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

References

https://security.netapp.com/advisory/ntap-20241115-0008/

https://pkg.go.dev/vuln/GO-2023-1752

https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU

https://go.dev/issue/59721

https://go.dev/cl/491616

Details

Source: Mitre, NVD

Published: 2023-05-11

Updated: 2026-06-17

Named Vulnerability: GO-2023-1752Named Vulnerability: GHSA-7qhm-5mxq-x7vp

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.0156