CVE-2026-118652

A flaw was found in Echo. When handling JSON with Padding JSONP responses, the framework concatenates callback values without proper validation or escaping. If an application exposes an endpoint that passes untrusted input into the callback parameter, a remote attacker can conduct a reflected...