CVE-2020-29510

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-115

Affected software

Vendor	Product	Versions
Golang	Go	>= unspecified, <= 1.15

References

https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.mdThird Party Advisory
https://security.netapp.com/advisory/ntap-20210129-0006/Third Party Advisory
https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.mdThird Party Advisory
https://security.netapp.com/advisory/ntap-20210129-0006/Third Party Advisory

Timeline

Published: Dec 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-295115.6The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization ro CVE-2020-29526.5Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affecte CVE-2020-295297.5HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypas CVE-2020-29539.8Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promoti CVE-2020-295347.8An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that CVE-2020-295355.4Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit t CVE-2020-295364.3Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to servic CVE-2020-295375.4Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitima CVE-2020-295384.9Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated malicious administrative CVE-2020-295395.4A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor to have a remote au CVE-2020-29546.1Vulnerability in the PeopleSoft Enterprise HRMS product of Oracle PeopleSoft (component: Candidate Gateway). The supported version that is a CVE-2020-295407.5API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Serv