CVE-2024-22199

The vulnerability results from the lack of default autoescape mechanism enablement in the Django template engine integrated with the Fiber framework (gofiber/template package). When the application passes user-supplied input data to a template, it is rendered without sanitization, allowing arbitrary JavaScript code to be embedded and executed in the victim's browser context. The fix involves setting the autoescape option to true as the default template engine configuration.

An attacker can execute malicious JavaScript code in the browser of another user visiting the vulnerable site, which may lead to session hijacking, credential theft, or further attacks on application users.

The gofiber/template package should be updated to a version containing commit 28cff3ac4d4c117ab25b5396954676d624b6cb46, which enables autoescape by default. Additionally, it is recommended to audit the application code for rendering of untrusted user input in templates.

Web applications using the gofiber/template package (Django template engine for the Fiber framework) that render user-supplied data — versions indicated in the manufacturer's references