Reflected Cross-Site Scripting in Echo Web Framework by Labstack
CVE-2026-118652
6.1MEDIUM
What is CVE-2026-118652?
The Echo web framework from Labstack exposes a vulnerability in its Context.JSONP and Context.JSONPBlob functions, which concatenate unvalidated callback values into JavaScript responses. This flaw can lead to reflected cross-site scripting (XSS) attacks, where an attacker can manipulate the callback value. By exploiting routes that accept user inputs as callback arguments, attackers can inject and execute arbitrary scripts when users interact with the corresponding responses. Users are encouraged to upgrade to versions 4.16.0 or 5.4.0, where the issue has been addressed, to safeguard against potential attacks.
Affected Version(s)
echo < 4.16.0 < 4.16.0
echo >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0