Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/mccutchen/go-httpbin/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.3GoPublished

    Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

    CVE-2025-45286 · GHSA-528q-4pgm-wvg2

    Affected
    • Go github.com/mccutchen/go-httpbin/v2 < 2.18.0
    Fixed in
    2.18.0· Vendor fix available
    Issue
    The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser. Affected URLs: - /response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E - /base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html - /base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html Steps to reproduce: 1. Visit one of the above mentioned URLs. 2. XSS window will popup Suggested fix - Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers Criticality The following can be major impacts of the issue: Access to victim's sensitive Personal Identifiable Information. Access to CSRF token Cookie injection Phishing And any other thing Javascript can perform

    Recommended action: Upgrade to 2.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →