{"id":"GO-2026-5560","revision":"8aa9cae160bf4b1a929664feca94d23c","records":[{"revision":"8aa9cae160bf4b1a929664feca94d23c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5560","aliases":["CVE-2026-43644","GHSA-q23m-vm9r-5745"],"title":"podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo","description":"podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:30.1308602+00:00","affected":[{"ecosystem":"Go","name":"github.com/stefanprodan/podinfo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.1-0.20260519111337-cbebb20fd485"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-q23m-vm9r-5745","https://nvd.nist.gov/vuln/detail/CVE-2026-43644","https://github.com/stefanprodan/podinfo/commit/cbebb20fd48588d36fc7ff3e874c128eb89692f4","https://github.com/stefanprodan/podinfo/pull/480","https://github.com/stefanprodan/podinfo/issues/474","https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md","https://github.com/stefanprodan/podinfo/releases/tag/6.12.0","https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5560","license":"OSV · upstream source license applies","key":"osv:GO-2026-5560","identifiers":["GO-2026-5560","CVE-2026-43644","GHSA-q23m-vm9r-5745"]},"retained":false,"historicalAffected":[]}],"coverage":[]}