Reflected Cross-Site Scripting Vulnerability in Podinfo by Stefan Prodan
CVE-2026-43644

5.1MEDIUM

Key Information:

Vendor: Stefanprodan
Status: Podinfo
Vendor: CVE Published:; 14 May 2026

🔔 Create Stefanprodan Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-43644?

Podinfo versions up to 6.11.2 are vulnerable to a reflected cross-site scripting (XSS) flaw in the /echo and /api/echo endpoints. The vulnerability arises from the echoHandler writing request body content directly to the response without the appropriate Content-Type or X-Content-Type-Options headers. This oversight allows an attacker to craft malicious cross-origin HTML pages with auto-submitting forms, embedding script payloads in the request body. When a victim visits the attacker's page, the script payload can execute within the Podinfo context, compromising the security of user interactions.

Affected Version(s)

podinfo 0 <= 6.11.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-43644 - Proof of Concept