{"id":"GHSA-q23m-vm9r-5745","revision":"d5a0a8f7eef0493a9b4685c90dbaf1d6","records":[{"revision":"d5a0a8f7eef0493a9b4685c90dbaf1d6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q23m-vm9r-5745","aliases":["CVE-2026-43644","GO-2026-5560"],"title":"podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints","description":"podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.","state":0,"publishedAt":"2026-05-14T15:31:58+00:00","modifiedAt":"2026-06-25T23:11:09.8489771+00:00","affected":[{"ecosystem":"Go","name":"github.com/stefanprodan/podinfo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.1-0.20260519111337-cbebb20fd485"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-43644","https://github.com/stefanprodan/podinfo/issues/474","https://github.com/stefanprodan/podinfo/pull/480","https://github.com/stefanprodan/podinfo/commit/cbebb20fd48588d36fc7ff3e874c128eb89692f4","https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md","https://github.com/stefanprodan/podinfo","https://github.com/stefanprodan/podinfo/releases/tag/6.12.0","https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint"],"sourceUrl":"https://github.com/advisories/GHSA-q23m-vm9r-5745","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q23m-vm9r-5745","identifiers":["GHSA-q23m-vm9r-5745","CVE-2026-43644","GO-2026-5560"]},"retained":false,"historicalAffected":[]}],"coverage":[]}