Skip to content
OpenAdvisories
Medium · 6.1 CVE-2025-45286 EUVD-2025-7205GHSA-528q-4pgm-wvg2GO-2025-3554

Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

Published Jan 2, 2026 · Updated Jan 6, 2026 · Assigned by mitre

Package: github.com/mccutchen/go-httpbin Package: github.com/mccutchen/go-httpbin/v2 Ecosystem: Go

Description

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mccutchen/go-httpbin < 2.18.0 2.18.0 GHSA-528q-4pgm-wvg2
Go github.com/mccutchen/go-httpbin all versions — GO-2025-3554
Go github.com/mccutchen/go-httpbin/v2 < 2.18.0 2.18.0 GHSA-528q-4pgm-wvg2

References