onyx --cves cve-2023-24539

CVE-2023-24539

HIGHGo

score: <0.1
cvss: 7.3
epss: 1.0%
published: 2023-05-11
kev added: —
first seen: 2026-10-21

Templates containing multiple actions separated by '/' in CSS contexts can result in closing the CSS context and allow injection of unexpected HTML, exploit requires execution with untrusted input.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2023-05-11 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-74 CWE-94

References 5

https://go.dev/cl/491615
https://go.dev/issue/59720
https://pkg.go.dev/vuln/GO-2023-1751
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
https://security.netapp.com/advisory/ntap-20241129-0005/