Medium severityGoCross-Site Scripting (XSS)LOW confidence

Text Template For HTML

text/template performs NO HTML escaping; using it to generate HTTP/HTML responses exposes the application to cross-site scripting (CWE-79).

Standards mapping

CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10: A03:2021 - Injection
OWASP ASVS: V5.3.3 (L1)

Vulnerable vs. safe

Flagged by this check

import "text/template"

Passes - the safe pattern

import htmltemplate "html/template"

Why it matters & how to fix it

text/template performs NO HTML escaping; using it to generate HTTP/HTML responses exposes the application to cross-site scripting (CWE-79). Import html/template instead — it provides the same API but applies context-aware output encoding. Reserve text/template for non-HTML output such as config files, emails, or code generation.

References

Rule ID integsec-go-text-template-for-html - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks