Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118652— Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Quick assessment

Affected

labstack echo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Echo 是一个用 Go 语言编写的 Web 框架。在 4.16.0 和 5.4.0 版本之前，和会将未经验证的回调函数名称直接拼接进 JavaScript 响应中。若某个路由将攻击者可控的输入作为回调参数，则可能返回可执行的脚本语法，导致用户在加载该伪造响应时触发反射型跨站脚本（XSS）攻击。其中，路径未对回调函数进行任何验证或转义处理；要利用此漏洞，需要存在一个暴露回调参数控制权的應用路由。该问题已在 4.16.0 和 5.4.0 版本中修复。

CVSS 6.1 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
labstack	echo	`< 4.16.0`	affected
		`>= 5.0.0, < 5.4.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Source: CVE Program / CVE List V5

Vulnerability Description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
labstack	echo	< 4.16.0	-

II. Public POCs for CVE-2026-118652

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118652

请登录查看更多情报信息。

Other References for CVE-2026-118652 (5)

https://github.com/labstack/echo/releases/tag/v5.4.0 x_refsource_MISC
https://github.com/labstack/echo/releases/tag/v4.16.0 x_refsource_MISC
https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g x_refsource_CONFIRM
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 x_refsource_MISC
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118652

Same Patch Batch · labstack · 2026-10-28 · 16 CVEs total

CVE-2026-118264	9.1 CRITICAL	Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-118260	8.2 HIGH	Echo: BodyDump captures request and response bodies without size limits in v4
CVE-2026-118262	8.2 HIGH	Echo: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-118261	8.2 HIGH	Echo: Decompress permits unbounded gzip expansion in v4
CVE-2026-118650	7.5 HIGH	Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a sta
CVE-2026-118263	6.3 MEDIUM	Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-118656	6.1 MEDIUM	Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
CVE-2026-118654	5.9 MEDIUM	Echo static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-118655	5.9 MEDIUM	Echo: Static Middleware Double-Unescape Path Traversal
CVE-2026-118657	5.9 MEDIUM	Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651	5.3 MEDIUM	Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-118266	5.3 MEDIUM	Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118265	5.3 MEDIUM	Echo: X-Real-IP extractor trusts the header value instead of the sending peer
CVE-2026-118653	5.3 MEDIUM	Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-118658	4.7 MEDIUM	Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded

IV. Related Vulnerabilities

Same product: echo

Same vendor: labstack

Same weakness: CWE-79