{"id":"ghsa-ghsa-h9g5-28mm-hx3g","seq":2056987,"kind":"advisory","title":"Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob","url":"https://github.com/advisories/GHSA-h9g5-28mm-hx3g","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h9g5-28mm-hx3g","summary":"影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0\nThe Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. Present in current master and v5.1.0 (latest release). Vulnerable Code (verbatim) go func (c Context) j…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-118652"],"tags":["GHSA-h9g5-28mm-hx3g","github.com/labstack/echo/v5","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:54:05.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}