Vulnerability · CVE-2026-118652
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
Published Oct 28, 2026 · catalog updated Nov 5, 2026 · Echo vulnerable to Reflected
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-118652. EPSS is 0.24%. Act only if a listed version of Echo vulnerable to Reflected is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Echo vulnerable to Reflected).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium6.1
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.24%
- Remediation
- Advisory link
- Affected products
- Go github.com/labstack/echo/v4 · Go github.com/labstack/echo/v5 · golang github.com
### Summary The , , and internal helper in directly concatenate the caller-supplied parameter into a JavaScript response **without any validation, escaping, or allow-listing**. This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. **Present in current master and v5.1.0 (latest release).** ### Vulnerable Code (verbatim) No sanitization is performed on the callback string. ### Exploit (one-request repro) Any route using the official pattern is vulnerable: Attacker request: Server response: → Immediate arbitrary JavaScript execution (full reflected XSS). ### Impact - Session hijacking, cookie theft, account takeover, keylogging, defacement. - Works even with strict CSP (response is served as application/javascript). #### Affected Versions - All versions ≤ v5.1.0 (including current master) #### Workarounds Manually sanitize the callback before calling JSONP/JSONPBlob: Or migrate away from JSONP entirely (use CORS + application/json). ### References - https://github.com/labstack/echo/blob/master/context.go - https://echo.labstack.com/docs/cookbook/jsonp ## Patches Fixed in v5.4.0 and v4.16.0. and accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, and ); any other callback returns a 400 Bad Request error wrapping and nothing is written. JSONP responses also carry . ## Workarounds Validate the callback in your handler before calling , for example against , and set . JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/labstack/echo/v40 → 4.16.0
- Go github.com/labstack/echo/v50 → 5.4.0
- golang github.comversion unspecified
How to fix CVE-2026-118652
Upgrade
CVE-2026-118652 lists a fix boundary at 4.16.0. Compare the installed build with that boundary before you change production.
Version check
Fixed in 4.16.0 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-118652. EPSS is 0.24%. Act only if a listed version of Echo vulnerable to Reflected is installed.
Which versions are affected?
Compare what you have installed with 0 → 4.16.0, 0 → 5.4.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-79: Cross-site Scripting (XSS). EPSS 0.24%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitLab Advisory Database
Detected
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. Pres
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0; github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Updated
### Summary The , , and internal helper in directly concatenate the caller-supplied parameter into a JavaScript response **without any validation, escaping, or allow-listing**. This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. **Present in current master and v5.1.0 (late
Nov 5, 2026 · Go Vulnerability Database
Updated
### Summary The , , and internal helper in directly concatenate the caller-supplied parameter into a JavaScript response **without any validation, escaping, or allow-listing**. This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. **Present in current master and v5.1.0 (late
Sources
- CVE.orgVulnerability recordCVE-2026-118652
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-118652
30-day exploitation probability 0.24%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-118652
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing. This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. Pres
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-h9g5-28mm-hx3g
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
osv.dev
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- Go Vulnerability DatabaseNov 6, 2026
- FIRST EPSSNov 4, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026