CVE-2023-29453

Summary

CVE-2023-29453 introduces a vulnerability in templates where backticks, used as Javascript string delimiters, are not properly handled. Go template actions within Javascript template literals can cause the literal to be terminated, allowing the injection of arbitrary Javascript code. Due to the complexity of ES6 template literals and their interpolation capabilities, Go has decided to disallow Go template actions from being used inside of them. This change will result in an Error being returned by Template.Parse when such templates are encountered, starting with the release of Go 1.21. Users who require the previous behavior can enable it using the GODEBUG flag jstmpllitinterp=1, but are advised to exercise caution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.