CVE-2026-118652

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Summary The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by an...

GHSA-H9G5-28MM-HX3G Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Summary The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by an...

EUVD-2026-112408

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

CVE-2026-118652

The Echo Go web framework is vulnerable to reflected cross-site scripting (XSS) in versions prior to 4.16.0 and 5.4.0 . The Context.JSONP, Context.JSONPBlob, and the internal jsonPBlob helper in context.go concatenate caller-supplied callback parameters into a JavaScript response without validati...

CVE-2026-118652 Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

PT-2026-129168

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...