CVE-2023-3978

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
golang.org/x/net	golang.org/x/net/html	< 0.13.0

References

https://go.dev/cl/514896Patch
https://go.dev/issue/61615Issue Tracking, Patch, Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1988Issue Tracking, Patch, Vendor Advisory
https://go.dev/cl/514896Patch
https://go.dev/issue/61615Issue Tracking, Patch, Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1988Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Aug 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-397808.8On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist CVE-2023-397847.5Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function.CVE-2023-397857.5Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.CVE-2023-397867.5Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function.CVE-2023-39794.3An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.CVE-2023-397969.8SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via CVE-2023-39804.8Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.CVE-2023-398014.6A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Se CVE-2023-398046.2In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.CVE-2023-398059.8iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.CVE-2023-398069.8iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.CVE-2023-398079.8N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-reg