Read the docs
TI-2021-16746 Aliases CVE-2021-39391GHSA-c77f-4rgj-jfr4

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via…

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.

Why it matters now

EPSS 0.00795 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/beego/beego/v2 (Go): 2.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/beego/beego/v2 (Go)before 2.0.22.0.2Patch availableGHSA-c77f-4rgj-jfr4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/beego/beego/v2 (Go) Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available GHSA-c77f-4rgj-jfr4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:beego:beego:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablebeego
  • cpe:2.3:a:beego:beego:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·beego

Remediation

  • Fix · GHSA-c77f-4rgj-jfr4 github.com/beego/beego/v2 (Go) Fixed in 2.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39391
  2. 2026-10-03 Alias added: GHSA-c77f-4rgj-jfr4

References

Exploit 1

Advisory 2

  • TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
  • TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2022-13707 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with… CVSS 3.1CRITICAL 9.8
  • TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
  • TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
  • TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences