title: Improper handling of empty HTML attributes in html/template
description: Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
problem types: CWE-74: Improper input validation
affected:
{
vendor: Go standard library
product: html/template
collectionURL: https://pkg.go.dev
packageName: html/template
versions:
version: 0, lessThan: 1.19.9, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.4, status: affected, versionType: semver
programRoutines:
name: appendCmd
name: htmlNospaceEscaper
name: Template.Execute
name: Template.ExecuteTemplate
defaultStatus: unaffected
}