Read the docs
TI-2026-82187 Aliases CVE-2026-118652GHSA-h9g5-28mm-hx3g

Reflected cross-site scripting in Echo Go framework JSONP callback

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The Echo Go web framework before 4.16.0 and from 5.0.0 before 5.4.0 concatenates an unvalidated callback value into the JavaScript response of Context.JSONP and Context.JSONPBlob, a missing-escaping flaw (CWE-79). A remote attacker with no privileges can make a crafted response run script in a user's browser when the user loads it, but only if the application has a route that passes attacker-controlled input as the callback.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed echo (labstack): 4.16.0, 5.4.0github.com/labstack/echo/v5 (Go): 5.4.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackechobefore 4.16.0; 5.0.0 to before 5.4.04.16.0, 5.4.0Patch availableCNA
—github.com/labstack/echo/v5 (Go)before 5.4.05.4.0Patch availableGHSA-h9g5-28mm-hx3g
—github.com/labstack/echo/v4 (Go)before 4.16.04.16.0Patch availableGHSA-h9g5-28mm-hx3g
  • echo Vendorlabstack Affected before 4.16.0; 5.0.0 to before 5.4.0 Fixed in 4.16.0, 5.4.0 Patch available CNA
  • github.com/labstack/echo/v5 (Go) Vendor— Affected before 5.4.0 Fixed in 5.4.0 Patch available GHSA-h9g5-28mm-hx3g
  • github.com/labstack/echo/v4 (Go) Vendor— Affected before 4.16.0 Fixed in 4.16.0 Patch available GHSA-h9g5-28mm-hx3g

Remediation

Update the github.com/labstack/echo/v4 module to 4.16.0 and the github.com/labstack/echo/v5 module to 5.4.0, which are the fixed versions for the labstack echo product.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 4.16.0, 5.4.0
  • Fix · GHSA-h9g5-28mm-hx3g github.com/labstack/echo/v5 (Go) Fixed in 5.4.0 Advisory →
  • Fix · GHSA-h9g5-28mm-hx3g github.com/labstack/echo/v4 (Go) Fixed in 4.16.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118652
  2. 2026-10-28 Alias added: GHSA-h9g5-28mm-hx3g
  3. 2026-10-28 Fix available: Go/github.com/labstack/echo/[email protected], Go/github.com/labstack/echo/[email protected] · GHSA-h9g5-28mm-hx3g
  4. 2026-10-28 CVSS score added · GHSA-h9g5-28mm-hx3g
  5. 2026-10-28 Weakness changed · GHSA-h9g5-28mm-hx3g
  6. 2026-10-28 6 new references · GHSA-h9g5-28mm-hx3g
  7. 2026-10-30 Priority changed: MEDIUM → LOW
  8. 2026-11-03 CISA SSVC decision points changed
  9. 2026-11-03 Priority changed: LOW → MEDIUM
  10. 2026-11-06 Affected versions changed · Red Hat
  11. 2026-11-06 CVSS score added · Red Hat

References

Other 6

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences