cve 2023 24538

CVE-2023-24538 is a security vulnerability in the Go standard library's html/template package. It allowed JavaScript backticks (ES6 template literals) to be treated as string delimiters, enabling template actions to break out of quoted JavaScript contexts and inject arbitrary script. The Go maintainers fixed this by disallowing template actions inside JavaScript template literals, causing parsing failures for such templates. Developers and operators must update their Go version, audit templates, and adjust how server-side values are embedded into client-side scripts to mitigate this issue.