{"id":"EUVD-2026-30275","enisaUuid":"3820e626-8d06-3540-9733-349aaf21bf1c","description":"podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go\u0027s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker\u0027s page.","datePublished":"May 14, 2026, 12:37:40 PM","dateUpdated":"Oct 8, 2026, 3:22:43 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md\nhttps://github.com/stefanprodan/podinfo/issues/474\nhttps://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint\n","aliases":"CVE-2026-43644\nGHSA-q23m-vm9r-5745\n","assigner":"VulnCheck","epss":0.2,"enisaIdProduct":[{"id":"5e8ace78-0205-30a7-9c7e-2446d94323be","product":{"name":"podinfo","vendor":{"name":"stefanprodan"}},"product_version":"0 ≤6.11.2"}],"enisaIdVendor":[{"id":"573f4790-84bc-31b8-9999-6acd42d5dc66","vendor":{"name":"stefanprodan"}}],"enisaIdVulnerability":[{"id":"05d4dfe6-26b2-3ec9-ada2-a2b5695e5586","vulnerability":{"id":"CVE-2026-43644","description":"podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go\u0027s content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker\u0027s page.","datePublished":"May 14, 2026, 12:37:40 PM","dateUpdated":"Oct 8, 2026, 3:22:43 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md\nhttps://github.com/stefanprodan/podinfo/issues/474\nhttps://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint\n","enisa_id":"EUVD-2026-30275\n","assigner":"VulnCheck","epss":0.2,"dataProcessed":"Oct 28, 2026, 7:16:27 AM","vulnerabilityProduct":[{"id":"e90e72a7-a189-3c7f-ab6c-a40b7ab625e9","product":{"name":"podinfo","vendor":{"name":"stefanprodan"}},"product_version":"0 ≤6.11.2"}],"vulnerabilityVendor":[{"id":"c71eafe1-75f5-3745-ac4c-954c36f571cc","vendor":{"name":"stefanprodan"}}]}},{"id":"0d2070b6-5bbc-3a4f-82a0-25b2f8dd2915","vulnerability":{"id":"GHSA-q23m-vm9r-5745","description":"podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints","datePublished":"May 14, 2026, 3:31:58 PM","dateUpdated":"May 20, 2026, 3:48:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-43644\nhttps://github.com/stefanprodan/podinfo/issues/474\nhttps://github.com/stefanprodan/podinfo/pull/480\nhttps://github.com/stefanprodan/podinfo/commit/cbebb20fd48588d36fc7ff3e874c128eb89692f4\nhttps://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md\nhttps://github.com/stefanprodan/podinfo\nhttps://github.com/stefanprodan/podinfo/releases/tag/6.12.0\nhttps://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint\n","enisa_id":"EUVD-2026-30275\n","aliases":"GHSA-q23m-vm9r-5745\nCVE-2026-43644\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}