CVE-2023-29400 — Improper handling of empty HTML attributes in html/template
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML norma…
Published: 2023-05-11 · CVSS: 7.3 · CVSS 3.1
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7