CVE-2023-24540

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Go standard libraryhtml/template< 1.19.9; >= 1.20.0-0, < 1.20.4

References

Timeline

Published
May 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user tCVE-2023-245448.1Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.CVE-2023-245457.5On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attCVE-2023-245468.1On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicioCVE-2023-245476.5On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can beCVE-2023-245486.5On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded inCVE-2023-245497.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The CVE-2023-24555.4Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases whCVE-2023-245507.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The CVE-2023-245517.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The CVE-2023-245527.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The CVE-2023-245537.8A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The
CVE-2023-24540: Critical severity, CVSS 9.8 | Vulnix