May 11, 2023, 4:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

actions attributes cve html injection input may normalization result results rules

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Information Security Senior Analyst

@ Media.Monks | Americas: USA + Canada

Senior Program Associate- Cybersecurity Awareness (Remote)

@ Fannie Mae | Washington, DC, United States

Cybersecurity Specialist - Endpoint Security

@ Hexagon US Federal | Huntsville, AL