CVE-2024-24785

5.4 mediumEPSS 0.8%

Medium (5.4). EPSS 0.8% chance of exploitation in the next 30 days. Fixed in stdlib 1.21.8, 1.22.1.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
Published: 2024-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2024-2610	Go	stdlib	<1.21.8 >=1.22.0-0 <1.22.1	1.21.8, 1.22.1

References

http://www.openwall.com/lists/oss-security/2024/03/08/4
https://go.dev/cl/564196
https://go.dev/issue/65697
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
https://pkg.go.dev/vuln/GO-2024-2610

Check your stack JSON