CVE-2023-29400

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-294014.3The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the ContenCVE-2023-294029.8The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program wCVE-2023-294037.8On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in cerCVE-2023-294049.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294059.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294066.5The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers oCVE-2023-294076.5A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cauCVE-2023-294086.5The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small iCVE-2023-294095.3Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the CVE-2023-29414.3Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install aCVE-2023-294108.8A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the applicCVE-2023-294119.8A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading
CVE-2023-29400: High severity, CVSS 7.3 | Vulnix