{"id":"UBUNTU-CVE-2023-24539","details":"Angle brackets (\u003c\u003e) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.","modified":"2026-01-30T01:04:41.571306Z","published":"2023-05-11T16:15:00Z","withdrawn":"2025-07-18T16:54:21Z","related":["USN-6140-1"],"upstream":["CVE-2023-24539"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-24539"},{"type":"REPORT","url":"https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"},{"type":"REPORT","url":"https://github.com/golang/go/issues/59720"},{"type":"REPORT","url":"https://github.com/golang/go/commit/e49282327b05192e46086bf25fd3ac691205fe80"},{"type":"REPORT","url":"https://github.com/golang/go/commit/090590fdccc8442728aa31601927da1bf2ef1288"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6140-1"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-24539"}],"affected":[{"package":{"name":"golang-1.20","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/golang-1.20@1.20.3-1ubuntu0.1~20.04?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~20.04"}]}],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"golang-1.20","binary_version":"1.20.3-1ubuntu0.1~20.04"},{"binary_name":"golang-1.20-doc","binary_version":"1.20.3-1ubuntu0.1~20.04"},{"binary_name":"golang-1.20-go","binary_version":"1.20.3-1ubuntu0.1~20.04"},{"binary_version":"1.20.3-1ubuntu0.1~20.04","binary_name":"golang-1.20-go-dbgsym"},{"binary_name":"golang-1.20-src","binary_version":"1.20.3-1ubuntu0.1~20.04"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-24539.json"}},{"package":{"name":"golang-1.20","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/golang-1.20@1.20.3-1ubuntu0.1~22.04?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~22.04"}]}],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"1.20.3-1ubuntu0.1~22.04","binary_name":"golang-1.20"},{"binary_name":"golang-1.20-doc","binary_version":"1.20.3-1ubuntu0.1~22.04"},{"binary_name":"golang-1.20-go","binary_version":"1.20.3-1ubuntu0.1~22.04"},{"binary_name":"golang-1.20-go-dbgsym","binary_version":"1.20.3-1ubuntu0.1~22.04"},{"binary_name":"golang-1.20-src","binary_version":"1.20.3-1ubuntu0.1~22.04"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-24539.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}