title: Improper sanitization of CSS values in html/template
description: Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
problem types: CWE-74: Improper input validation
affected:
{
vendor: Go standard library
product: html/template
collectionURL: https://pkg.go.dev
packageName: html/template
versions:
version: 0, lessThan: 1.19.9, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.4, status: affected, versionType: semver
programRoutines:
name: cssValueFilter
name: escaper.commit
name: Template.Execute
name: Template.ExecuteTemplate
defaultStatus: unaffected
}