{"id":"CVE-2026-118652","aliases":["GHSA-h9g5-28mm-hx3g"],"title":"Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nThe `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callback` parameter into a JavaScript response **without any validation, escaping, or allow-listing**.  \n\nThis creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.\n\n**Present in current master and v5.1.0 (latest release).**\n\n### Vulnerable Code (verbatim)\n\n```go\nfunc (c *Context) jsonPBlob(code int, callback string, i any) (err error) {\n\tc.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)\n\tc.response.WriteHeader(code)\n\tif _, err = c.response.Write([]byte(callback + \"(\")); err != nil {\n\t\treturn\n\t}\n\tif err = c.echo.JSONSerializer.Serialize(c, i, \"\"); err != nil {\n\t\treturn\n\t}\n\tif _, err = c.response.Write([]byte(\");\")); err != nil {\n\t\treturn\n\t}\n\treturn\n}\n\nfunc (c *Context) JSONP(code int, callback string, i any) (err error) {\n\treturn c.jsonPBlob(code, callback, i)\n}\n\nfunc (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {\n\tc.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)\n\tc.response.WriteHeader(code)\n\tif _, err = c.response.Write([]byte(callback + \"(\")); err != nil {\n\t\treturn\n\t}\n\tif _, err = c.response.Write(b); err != nil {\n\t\treturn\n\t}\n\t_, err = c.response.Write([]byte(\");\"))\n\treturn\n}\n```\nNo sanitization is performed on the callback string.\n\n### Exploit (one-request repro)\nAny route using the official pattern is vulnerable:\n```\nGoe.GET(\"/api\", func(c echo.Context) error {\n    return c.JSONP(200, c.QueryParam(\"callback\"), map[string]string{\"status\": \"ok\"})\n})\n```\nAttacker request:\n```\nGET /api?callback=alert(document.domain)%2f%2f HTTP/1.1\nHost: target.com\n```\nServer response:\n```\nContent-Type: application/javascript; charset=utf-8\n\nalert(document.domain)//({\"status\":\"ok\"});\n```\n→ Immediate arbitrary JavaScript execution (full reflected XSS).\n### Impact\n\n- Session hijacking, cookie theft, account takeover, keylogging, defacement.\n- Works even with strict CSP (response is served as application/javascript).\n\n#### Affected Versions\n\n- All versions ≤ v5.1.0 (including current master)\n\n#### Workarounds\nManually sanitize the callback before calling JSONP/JSONPBlob:\n```\nGofunc safeCallback(cb string) string {\n    if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\\[\\]]+$`, cb); !matched {\n        return \"callback\"\n    }\n    return cb\n}\n```\nOr migrate away from JSONP entirely (use CORS + application/json).\n### References\n\n- https://github.com/labstack/echo/blob/master/context.go\n- https://echo.labstack.com/docs/cookbook/jsonp\n\n## Patches\n\nFixed in `github.com/labstack/echo/v5` v5.4.0 and `github.com/labstack/echo/v4` v4.16.0. `Context.JSONP` and `Context.JSONPBlob` accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, `_` and `$`); any other callback returns a 400 Bad Request error wrapping `ErrInvalidJSONPCallback` and nothing is written. JSONP responses also carry `X-Content-Type-Options: nosniff`.\n\n## Workarounds\n\nValidate the callback in your handler before calling `Context.JSONP`, for example against `^[A-Za-z_$][A-Za-z0-9_$]*(\\.[A-Za-z_$][A-Za-z0-9_$]*)*$`, and set `X-Content-Type-Options: nosniff`. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.","severity":"medium","score":6.1,"published":"2026-10-28T19:35:47.103Z","modified":"2026-10-28T20:15:05.451Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","sources":[{"name":"OSV · GHSA-h9g5-28mm-hx3g","url":"https://osv.dev/vulnerability/GHSA-h9g5-28mm-hx3g"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.4.0"}],"type":"SEMVER"}],"versions":[],"fixed":["5.4.0"]},{"ecosystem":"Go","name":"github.com/labstack/echo/v4","sources":[{"name":"OSV · GHSA-h9g5-28mm-hx3g","url":"https://osv.dev/vulnerability/GHSA-h9g5-28mm-hx3g"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.16.0"}],"type":"SEMVER"}],"versions":[],"fixed":["4.16.0"]}],"sourceAffected":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo"],"sources":[{"name":"CVE","id":"CVE-2026-118652","modified":"2026-10-28T19:35:47.103Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118652"},{"name":"OSV","id":"GHSA-h9g5-28mm-hx3g","modified":"2026-10-28T20:15:05.451169812Z","url":"https://osv.dev/vulnerability/GHSA-h9g5-28mm-hx3g"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"cve":{"records":[{"id":"CVE-2026-118652","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T17:25:37.561Z","published":"2026-10-28T19:35:47.103Z","modified":"2026-10-28T19:35:47.103Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-28T19:35:47.103Z"}],"references":[{"url":"https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/releases/tag/v4.16.0","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/releases/tag/v5.4.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"labstack","name":"echo","platforms":[],"versions":[{"version":"< 4.16.0","status":"affected"},{"version":">= 5.0.0, < 5.4.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118652"}],"remediation":[],"observedAt":"2026-10-29T15:06:36.040Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:00:34.533Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T00:30:32.811Z","attemptedAt":"2026-10-29T00:30:32.811Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T00:30:32.811Z","attemptedAt":"2026-10-29T00:30:32.811Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T00:30:32.811Z","attemptedAt":"2026-10-29T00:30:32.811Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T00:30:33.731Z","attemptedAt":"2026-10-29T00:30:33.731Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118652","modified":"2026-10-28T20:17:22.250","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-29T00:30:32.811Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112408","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112408","modified":"Oct 28, 2026, 7:35:47 PM","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-29T00:30:32.811Z"},{"source":"GitHub Advisory Database","id":"GHSA-h9g5-28mm-hx3g","url":"https://github.com/advisories/GHSA-h9g5-28mm-hx3g","modified":"2026-10-28T19:54:06Z","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-29T00:30:32.811Z"}],"aiSummary":{"text":"The labstack echo product, versions ≤ v5.1.0, has a reflected Cross-Site Scripting (XSS) vulnerability via unsanitized JSONP callback in Context.JSONP and Context.JSONPBlob. An attacker with access to the callback parameter can trigger arbitrary JavaScript execution. The impact includes session hijacking and cookie theft.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:08:25.627Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118652"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-h9g5-28mm-hx3g"}]}}