Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/stefanprodan/podinfo < 1.8.1-0.20260519111337-cbebb20fd485
Fixed in
1.8.1-0.20260519111337-cbebb20fd485· Vendor fix available
Issue
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.
Recommended action: Upgrade to 1.8.1-0.20260519111337-cbebb20fd485 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/stefanprodan/podinfo <= 1.8.1-0.20250515093358-fb3b01be30a3
Fixed in
1.8.1-0.20260314125853-83deb7fcb742· Vendor fix available
Issue
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).
Recommended action: Upgrade to 1.8.1-0.20260314125853-83deb7fcb742 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.