CVE-2023-29400

score

<0.1

cvss

7.3

epss

1.0%

published

2023-05-11

kev added

—

first seen

2026-10-21

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules, letting attackers inject arbitrary attributes into tags, exploit requires crafted input.