Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
| Link | Tags |
|---|---|
| https://go.dev/issue/59720 | patch issue tracking |
| https://go.dev/cl/491615 | patch |
| https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU | release notes mailing list |
| https://pkg.go.dev/vuln/GO-2023-1751 | vendor advisory |
| https://security.netapp.com/advisory/ntap-20241129-0005/ |