podinfo CVE-2026-43644

podinfo is a Go-based microservice demonstration application. The vulnerability stems from inadequate HTTP header handling in the echoHandler function, which processes POST requests to /echo and /api/echo endpoints. When a request body is echoed back in the response, the absence of explicit Content-Type headers (such as text/plain or application/json) and the missing X-Content-Type-Options: nosniff header causes Go's http.ResponseWriter to perform automatic content type detection based on the response body. If the body contains HTML-like content (e.g., script tags), Go defaults the response to text/html, enabling the browser to parse and execute embedded JavaScript. This is a classic reflected XSS (CWE-79) vulnerability where user-controlled input (the request body) is rendered in the response without sanitization or encoding. The attack vector leverages cross-origin form submission: an attacker hosts a malicious HTML page with a form that auto-submits to the podinfo instance, causing the victim's browser to send a POST request with a script payload in the body. The same-origin policy does not block the form submission itself, only the attacker's ability to read the response-however, the attacker does not need to read the response; the JavaScript executes within the podinfo origin when the victim's browser processes the response.