Improper Neutralization of Special Elements Used in a Template Engine
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine |
| Confidence Level | Medium |
| Impact Level | High |
| Likelihood Level | Low |
Description#
User input is being directly incorporated into the template string before parsing with html/template, allowing attackers to inject malicious template code. This can lead to execution of unintended actions on the server side.
Impact#
If exploited, an attacker could execute arbitrary template code on the server, potentially exposing sensitive data, altering application behavior, or performing unauthorized actions. This could result in data breaches, privilege escalation, or complete compromise of the application.