title: Errors returned from JSON marshaling may break template escaping in html/template
description: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
problem types: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
affected:
{
vendor: Go standard library
product: html/template
collectionURL: https://pkg.go.dev
packageName: html/template
versions:
version: 0, lessThan: 1.21.8, status: affected, versionType: semver
version: 1.22.0-0, lessThan: 1.22.1, status: affected, versionType: semver
programRoutines:
name: jsValEscaper
name: escaper.commit
name: Template.Execute
name: Template.ExecuteTemplate
defaultStatus: unaffected
}