Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118652 · GHSA-h9g5-28mm-hx3g

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Risk score
42/100
CVSS
6.1 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads t…
Affected
github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0
Fix
Upgrade github.com/labstack/echo/v5 to 5.4.0; github.com/labstack/echo/v4 to 4.16.0 or later.
Exploitation
No known exploitation

Story map

Story map: github.com/labstack/echo/v5THE FLAWSTHE FIXCVE-2026-118652Echo vulnerable to ReflectedCross-Site Scripting (XSS) viaunsanitized JSONP callback in…CVSS 6.1CVE-2026-118650Echo's middleware.Static:`%2F`-encoded path bypassesroute/group middleware…CVSS 7.5CVE-2026-118656Echo has Open Redirect viaControl-Character PrefixDefeating sanitizeURICVSS 6.1CVE-2026-118657Echo: HTTPS Redirect and HSTSBypass via Unconditional Trustof Forwarded Scheme HeadersCVSS 5.9Upgrade…4.16.0 · 5.4.0or later on your release lineWho is exposedgithub.com/labstack/echo/v5(go) < 5.4.0;github.com/labstack/echo/v4(go) < 4.16.0YELLOW · PLAN IT INgithub.com/labstack/echo/v5Echo is a Go web framework.Prior to 4.16.0 and 5.4.0, aglobally mountedmiddleware.Static instance caninterpret an encoded requestpath differently from Echo'srouter because the router…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

  • CVE-2026-118652: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVSS 6.1)
  • CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
  • CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
  • CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/labstack/echo/v5go< 5.4.05.4.0
github.com/labstack/echo/v4go< 4.16.04.16.0

References

Original description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.