KEVWire

Security intelligence, with context.

Response snapshot Oct 29, 2026, 01:26 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-118652

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.

Published Updated

At a glance

Exploited
Not known
Severity
6.1 Medium (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: github.com/labstack/echo/v5: 5.4.0; github.com/labstack/echo/v4: 4.16.0. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-h9g5-28mm-hx3g (opens a new tab)

What happened

Summary

The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.

This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.

Present in current master and v5.1.0 (latest release).

Continue reading

Vulnerable Code (verbatim)

func (c *Context) jsonPBlob(code int, callback string, i any) (err error) {
 c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
 c.response.WriteHeader(code)
 if _, err = c.response.Write([]byte(callback + "(")); err != nil {
 return
 }
 if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil {
 return
 }
 if _, err = c.response.Write([]byte(");")); err != nil {
 return
 }
 return
}

func (c *Context) JSONP(code int, callback string, i any) (err error) {
 return c.jsonPBlob(code, callback, i)
}

func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {
 c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
 c.response.WriteHeader(code)
 if _, err = c.response.Write([]byte(callback + "(")); err != nil {
 return
 }
 if _, err = c.response.Write(b); err != nil {
 return
 }
 _, err = c.response.Write([]byte(");"))
 return
}

No sanitization is performed on the callback string.

Exploit (one-request repro)

Any route using the official pattern is vulnerable:

Goe.GET("/api", func(c echo.Context) error {
 return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"})
})

Attacker request:

GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1
Host: target.com

Server response:

Content-Type: application/javascript; charset=utf-8

alert(document.domain)//({"status":"ok"});

→ Immediate arbitrary JavaScript execution (full reflected XSS).

Impact

- Session hijacking, cookie theft, account takeover, keylogging, defacement. - Works even with strict CSP (response is served as application/javascript).

Affected Versions

- All versions ≤ v5.1.0 (including current master)

Workarounds

Manually sanitize the callback before calling JSONP/JSONPBlob:

Gofunc safeCallback(cb string) string {
 if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\[\]]+$`, cb); !matched {
 return "callback"
 }
 return cb
}

Or migrate away from JSONP entirely (use CORS + application/json).

References

- https://github.com/labstack/echo/blob/master/context.go - https://echo.labstack.com/docs/cookbook/jsonp

Patches

Fixed in github.com/labstack/echo/v5 v5.4.0 and github.com/labstack/echo/v4 v4.16.0. Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $); any other callback returns a 400 Bad Request error wrapping ErrInvalidJSONPCallback and nothing is written. JSONP responses also carry X-Content-Type-Options: nosniff.

Workarounds

Validate the callback in your handler before calling Context.JSONP, for example against ^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$, and set X-Content-Type-Options: nosniff. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.

Affected package ranges reported by GitHub: github.com/labstack/echo/v5: < 5.4.0 github.com/labstack/echo/v4: < 4.16.0

Scores and how they were measured

CVSS base severity

6.1

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow Go modules: RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-h9g5-28mm-hx3g (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-h9g5-28mm-hx3g, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 28). Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVE-2026-118652). https://kevwire.com/record/CVE-2026-118652

MLA

"Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVE-2026-118652)." KEVWire, 28 Oct. 2026, kevwire.com/record/CVE-2026-118652.

Chicago

KEVWire. "Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVE-2026-118652)." Last modified October 28, 2026. https://kevwire.com/record/CVE-2026-118652.

Evidence summary (plain text)

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (Oct 28, 2026).
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.

This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.

Present in current master and v5.1.0 (latest release).

No sanitization is performed on the callback string.
CVSS 6.1 (version 3.1; evidence as of Oct 28, 2026; https://github.com/advisories/GHSA-h9g5-28mm-hx3g).
Sources:
GitHub-reviewed advisory GHSA-h9g5-28mm-hx3g: https://github.com/advisories/GHSA-h9g5-28mm-hx3g
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-118652.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 29, 2026, 00:55 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail