EUVD-2026-112408
GHSA-h9g5-28mm-hx3g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify JSONP endpoint using callback param
-
DeliveryCraft malicious callback link
-
ExploitLure victim to click link
-
ExecutionInjected script executes in app origin
-
ImpactExfiltrate session cookies / hijack account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to actually invoke Echo's Context.JSONP or Context.JSONPBlob and to pass attacker-influenceable data (query string, form, header, or path parameter) as the callback argument - the official JSONP cookbook pattern is sufficient. Echo's own defaults are not inherently vulnerable: an application that never uses JSONP is unaffected. Beyond that, exploitation is limited by the CVSS UI:R requirement - a victim must be induced to visit or click the attacker-crafted URL - and it delivers reflected (not stored/persistent) script execution. No authentication is required of the attacker (PR:N), and the flaw affects all Echo versions ≤ v5.1.0 and the v4 branch below v4.16.0; it is remediated only by upgrading to v5.4.0 / v4.16.0 (which enforce callback allow-listing and add X-Content-Type-Options: nosniff) or by manually validating the callback before calling JSONP. |
| Impact | This is a medium-severity (CVSS 6.1) reflected XSS in the Echo Go framework's JSONP helpers, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) correctly reflects a network-reachable, unauthenticated, low-complexity flaw that requires victim interaction and crosses a security scope (script executes in the page's origin). It is NOT a high-CVSS-but-low-real-risk issue in absolute terms, but its real-world exploitability is strongly conditional: the vulnerability only manifests when an application actually calls Context.JSONP/JSONPBlob with attacker-influenced callback data, so it is a library-level flaw whose blast radius depends entirely on downstream usage. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a serious-but-not-fire-drill priority. KEV status is NOT present (no confirmed active exploitation), and no EPSS score was provided, so exploitation-probability cannot be quantified from the input - this absence should not be read as low risk, merely as unmeasured. A working one-request proof-of-concept is published in the GHSA advisory itself. Notably, because the response is served as application/javascript, the advisory states the attack works even against strict CSP, which modestly raises practical impact over a typical reflected XSS. Overall: a legitimate priority for any Echo deployment that uses JSONP, de-prioritizable (but still worth patching) for deployments that do not. |
| Exploit ScenarioDerived | An attacker identifies an application route that passes user-controlled input (e.g. a ?callback= query parameter) into Echo's Context.JSONP, then crafts a URL such as /api?callback=alert(document.domain)// and lures a logged-in victim into clicking it. Echo reflects the callback verbatim into an application/javascript response, so the injected script executes in the application's origin, enabling cookie theft, session hijacking, or account takeover. A working one-request proof-of-concept is published in the GHSA advisory, and the advisory notes it succeeds even under strict CSP because of the JavaScript content type. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Reflected cross-site scripting in the Labstack Echo Go web framework's Context.JSONP, Context.JSONPBlob and internal jsonPBlob helper, which write the caller-supplied callback string into an application/javascript response verbatim, with no validation, escaping or allow-listing. Echo v5 releases up to and including v5.1.0 (including current master at the time of reporting) and v4 releases below v4.16.0 are affected, but only applications that actually call the JSONP helpers and pass attacker-influenceable data (query string, form field, header or path parameter) as the callback are exploitable; the official JSONP cookbook pattern is sufficient to reach that state, while applications that never use JSONP are unaffected. Exploitation is unauthenticated from the attacker's side (CVSS PR:N) but requires victim interaction (UI:R): the attacker must lure a user to a crafted URL, after which arbitrary JavaScript runs in the target origin and can hijack sessions, steal cookies or deface pages, and because the payload is delivered as application/javascript it is not neutralised by ordinary script-src CSP rules. The vendor advisory includes a minimal one-request reproduction; no CISA KEV entry or confirmed public exploit tooling was identified at time of analysis, and the priority signal places remediation within this month. Fixed in Echo v5.4.0 and v4.16.0.
RemediationAI
Vendor-released patch: upgrade to github.com/labstack/echo/v5 v5.4.0 or github.com/labstack/echo/v4 v4.16.0 (fix commits b838391e2eade87ae7e5a09d7bb5087bec271ec1 and fc410094b2f3415cf2bf5204082137b205bfd5af, advisory GHSA-h9g5-28mm-hx3g). Be aware of the associated behaviour change before rolling out: JSONP callbacks that are not valid JavaScript identifiers now yield a 400 Bad Request wrapping ErrInvalidJSONPCallback and no body is written, which will break any existing client that sends unconventional callback names. If an immediate upgrade is not possible, the vendor-documented workaround is to validate the callback in the handler before calling Context.JSONP against a strict identifier pattern such as ^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$ and to set X-Content-Type-Options: nosniff on those responses, accepting that handler-level validation must be applied to every JSONP route and can be forgotten in future code. The advisory also recommends migrating away from JSONP entirely in favour of CORS with application/json, and notes that JSONP responses can be read by any website using the victim's cookies, so authenticated data should not be served through JSONP at all; adopting CORS removes this exposure class but requires reworking client-side script-tag data loading. Verify deployments against the CPE modules pkg:go/github.com_labstack_echo_v4 and pkg:go/github.com_labstack_echo_v5 in your Go dependency graph.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Echo is a Go net/http web framework, and JSONP is a legacy cross-origin data-retrieval technique in which the server wraps a JSON payload in a client-named JavaScript function call so a consuming page can load it via a <script> tag and bypass the same-origin policy by design. In the vulnerable context.go code, jsonPBlob writes Content-Type application/javascript, then concatenates the raw callback string with an opening parenthesis, serializes the payload, and appends ');'. JSONP and JSONPBlob are thin wrappers over that helper, so every JSONP response inherits the behaviour. The root cause is CWE-79 (improper neutralisation of user-controllable input in an output context): the callback parameter is treated as trusted text rather than constrained to the JavaScript identifier grammar it is supposed to represent, allowing injected characters such as a closing parenthesis followed by arbitrary statements and a line comment to break out of the intended function-call construct. The CPE identifiers pkg:go/github.com_labstack_echo_v5 and pkg:go/github.com_labstack_echo_v4 confirm both module major versions are in scope. The upstream fix replaces raw concatenation with an allow-list: the callback may be empty, a single JavaScript identifier, or a dot-separated path of identifiers using only ASCII letters, digits, underscore and dollar sign; anything else produces a 400 Bad Request error wrapping ErrInvalidJSONPCallback with no response body written, and JSONP responses now also set X-Content-Type-Options: nosniff. This is a reflected (not stored) issue, and the trigger depends entirely on the host application forwarding untrusted input into the callback argument; the framework default alone is not exploitable.
Know when Go gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable, unauthenticated, trivially crafted request (AV:N/AC:L/PR:N); victim must click the link (UI:R); script runs in the page origin, a scope change (S:C) with low confidentiality and integrity impact.
Primary rating from Vendor (https://github.com/labstack/echo).
CVSS VectorVendor: https://github.com/labstack/echo
DescriptionCVE.org
Summary
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.
This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.
Present in current master and v5.1.0 (latest release).
Vulnerable Code (verbatim)
func (c *Context) jsonPBlob(code int, callback string, i any) (err error) {
c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
c.response.WriteHeader(code)
if _, err = c.response.Write([]byte(callback + "(")); err != nil {
return
}
if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil {
return
}
if _, err = c.response.Write([]byte(");")); err != nil {
return
}
return
}
func (c *Context) JSONP(code int, callback string, i any) (err error) {
return c.jsonPBlob(code, callback, i)
}
func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {
c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
c.response.WriteHeader(code)
if _, err = c.response.Write([]byte(callback + "(")); err != nil {
return
}
if _, err = c.response.Write(b); err != nil {
return
}
_, err = c.response.Write([]byte(");"))
return
}No sanitization is performed on the callback string.
Exploit (one-request repro)
Any route using the official pattern is vulnerable:
Goe.GET("/api", func(c echo.Context) error {
return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"})
})Attacker request:
GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1
Host: target.comServer response:
Content-Type: application/javascript; charset=utf-8
alert(document.domain)//({"status":"ok"});→ Immediate arbitrary JavaScript execution (full reflected XSS).
Impact
- Session hijacking, cookie theft, account takeover, keylogging, defacement.
- Works even with strict CSP (response is served as application/javascript).
Affected Versions
- All versions ≤ v5.1.0 (including current master)
Workarounds
Manually sanitize the callback before calling JSONP/JSONPBlob:
Gofunc safeCallback(cb string) string {
if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\[\]]+$`, cb); !matched {
return "callback"
}
return cb
}Or migrate away from JSONP entirely (use CORS + application/json).
References
- https://github.com/labstack/echo/blob/master/context.go
- https://echo.labstack.com/docs/cookbook/jsonp
Patches
Fixed in github.com/labstack/echo/v5 v5.4.0 and github.com/labstack/echo/v4 v4.16.0. Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $); any other callback returns a 400 Bad Request error wrapping ErrInvalidJSONPCallback and nothing is written. JSONP responses also carry X-Content-Type-Options: nosniff.
Workarounds
Validate the callback in your handler before calling Context.JSONP, for example against ^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$, and set X-Content-Type-Options: nosniff. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Exploit-DB