---
id: CVE-2023-3978
aliases:
  - GHSA-2wrh-6pvc-2jm9
  - GO-2023-1988
title: Improper rendering of text nodes in golang.org/x/net/html
summary: Improper rendering of text nodes in golang.org/x/net/html
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: x
product: golang.org/x/net
ecosystem: go
affected:
  - golang.org/x/net < 0.13.0
patched:
  - golang.org/x/net 0.13.0
published: '2023-08-02'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:08.520271871Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2wrh-6pvc-2jm9'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-3978'
  - url: 'https://go.dev/cl/514896'
  - url: 'https://go.dev/issue/61615'
  - url: 'https://pkg.go.dev/vuln/GO-2023-1988'
tags:
  - osv
  - go
epss: 0.00851
epssPercentile: 0.56373
ingestedAt: '2026-09-12T03:13:01.746Z'
---

## Overview

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. 

## Affected packages

- `golang.org/x/net < 0.13.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/net 0.13.0`