Detections
Analytics

Golang: stdlib: security update to 1.19.8stdlib: security update to 1.20.3

critical Tenable Cloud Security Plugin ID 428493

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them
 as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template
 action within a Javascript template literal, the contents of the action can be used to terminate the
 literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather
 complex, and themselves can do string interpolation, the decision was made to simply disallow Go template
 actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to
 allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse
 returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is
 currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous
 behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will
 now be escaped. This should be used with caution. (CVE-2023-24538)

See Also

https://pkg.go.dev/vuln/GO-2023-1703

Plugin Details

Severity: Critical

ID: 428493

Version: Revision 1.4

Type: Local

Family: Golang

Published: 7/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.48

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-24538

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/5/2023

Vulnerability Publication Date: 4/5/2023

Reference Information

CVE: CVE-2023-24538