CVE-2026-118652 in Echo
Summary
by MITRE • 10/28/2026
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Echo web framework for Go contains a critical input validation flaw affecting versions prior to 4.16.0 and 5.4.0, specifically within the Context.JSONP and Context.JSONPBlob methods. These functions are designed to facilitate JSON with Padding (JSONP) responses, which allow cross-origin data retrieval by wrapping JSON payloads in a function call defined by a callback parameter provided by the client. The vulnerability arises because these methods concatenate an unvalidated user-supplied callback value directly into the JavaScript response body without performing any sanitization or escaping operations. This architectural oversight creates a direct pathway for reflected Cross-Site Scripting attacks, as the framework fails to distinguish between legitimate function names and malicious script payloads embedded within the callback parameter.
From a technical perspective, this flaw is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the direct string concatenation of attacker-controlled input into executable JavaScript code context. When an application route exposes the ability for users to control the callback argument, such as through a query parameter or URL path segment, an adversary can inject arbitrary JavaScript syntax. Because JSONP responses are typically served with content types that browsers interpret as executable scripts when loaded in certain contexts, particularly via script tags or cross-origin requests, the injected code executes within the victim's browser session context. This execution environment grants the attacker access to sensitive cookies, local storage data, and session tokens associated with the targeted domain.
The operational impact of this vulnerability is significant for any Echo-based application that implements JSONP endpoints without additional external validation layers. Exploitation requires a specific configuration where an application route passes user input directly into the callback parameter of these vulnerable methods. Once exploited, attackers can perform actions on behalf of authenticated users, steal sensitive information, or redirect victims to malicious sites. The severity is heightened by the fact that JSONP has historically been discouraged in modern web development due to its inherent security risks compared to standard CORS mechanisms, yet it remains in use for legacy compatibility and specific cross-domain data sharing requirements.
To mitigate this vulnerability, organizations must upgrade the Echo framework to version 4.16.0 or later, where these methods have been patched to properly validate and escape callback inputs. For applications that cannot immediately upgrade, implementing a strict allowlist of permitted callback function names is essential. This approach ensures that only predefined identifiers are accepted, effectively neutralizing script injection attempts. Additionally, developers should consider migrating away from JSONP entirely in favor of Cross-Origin Resource Sharing (CORS), which provides better security controls and does not require exposing data through executable JavaScript wrappers. Regular security audits focusing on input validation patterns within web frameworks can further prevent similar issues by ensuring that all dynamic content is properly sanitized before being rendered to the client side, aligning with OWASP best practices for preventing cross-site scripting attacks as outlined in their Cross-Site Scripting Prevention Cheat Sheet and mapped to MITRE ATT&CK technique T1059.