Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

User data is being inserted into HTML attributes using template.HTMLAttr() without proper escaping or sanitization. This allows potentially unsafe input to be included directly in HTML, increasing the risk of cross-site scripting (XSS).

Impact

If exploited, an attacker could inject malicious scripts into your web page, leading to session hijacking, data theft, or manipulation of page content. This compromises user trust and can expose sensitive information or allow further attacks against your application and its users.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Low

Description

User-controlled or dynamic data is being inserted into template.HTML() without proper escaping. This allows untrusted input to be rendered as raw HTML in web pages, creating a security risk.

Impact

If exploited, an attacker could inject malicious scripts (XSS) into the application, potentially stealing user credentials, hijacking sessions, or spreading malware to users. This can undermine user trust and expose sensitive data.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Writing user-controlled data directly to http.ResponseWriter using io.WriteString skips automatic HTML escaping, making it easy to introduce cross-site scripting (XSS) vulnerabilities. It’s safer to use the html/template package, which properly escapes output before sending it to users.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Writing user data directly to http.ResponseWriter using printf-style functions skips HTML escaping, leaving your application vulnerable to cross-site scripting (XSS). Instead, use Go’s html/template package to safely render dynamic content.

Impact

If exploited, an attacker could inject malicious scripts into your web pages, allowing them to steal user data, hijack sessions, or deface your site. This can compromise user trust and the security of your application and its users.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Detected ‘Fprintf’ or similar writing to ‘http.ResponseWriter’. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the ‘html/template’ package to render data to users.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Low
Likelihood Level	Low

Description

Using Go’s text/template package to render HTML does not automatically escape user-generated content, which can lead to unsafe output. This makes your web application vulnerable to Cross-Site Scripting (XSS) attacks.

Impact

If exploited, attackers can inject malicious scripts into your web pages, potentially stealing user data, hijacking sessions, or defacing your application. This can undermine user trust, compromise sensitive information, and expose your organization to security incidents.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Directly writing user input to http.ResponseWriter without proper HTML escaping can introduce cross-site scripting (XSS) vulnerabilities. Instead, use Go’s ‘html/template’ package to safely render user data in responses.

Impact

If exploited, attackers could inject malicious scripts into your web pages, leading to theft of user data, session hijacking, or manipulation of site content. This can compromise user trust and expose your application to regulatory and reputational risks.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Using functions like template.HTML(), template.JS(), or template.CSS() with non-constant or user-controlled input skips automatic escaping, which can lead to unsafe content being injected into templates. This allows attackers to include malicious scripts or HTML in your web pages.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being directly inserted into manually built HTML strings without proper sanitization. This bypasses safe rendering methods and can let malicious code be injected into web pages.

Impact

If exploited, attackers could execute JavaScript in users’ browsers (XSS), potentially stealing sensitive data like session cookies, impersonating users, or defacing your site. This can lead to data breaches and loss of user trust.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Assigning values directly to innerHTML or outerHTML can make your application vulnerable to Cross-Site Scripting (XSS) if the content includes user input. This allows attackers to inject malicious scripts into your web page.

Impact

If exploited, attackers could execute arbitrary JavaScript in the user’s browser, potentially stealing sensitive information, hijacking sessions, or performing actions on behalf of users. This can compromise user data, damage trust, and lead to broader security breaches.