## Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-118652
- 公開日時: 2026-10-28T19:54:05.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-h9g5-28mm-hx3g)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-h9g5-28mm-hx3g

影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. Present in current master and v5.1.0 (latest release). Vulnerable Code (verbatim) go func (c Context) j…