CVE-2025-45286
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type
Impact
### Description The go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser. ### Affected URLs: - `/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E` - `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html` - `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html` ### Steps to reproduce: 1. Visit one of the above mentioned URLs. 2. XSS window will popup ### Suggested fix - Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers ### Criticality The following can be major impacts of the issue: * Access to victim's sensitive Personal Identifiable Information. * Access to CSRF token * Cookie injection * Phishing * And any other thing Javascript can perform
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mccutchen/go-httpbin | < 2.18.0 | 2.18.0 |
| go | github.com/mccutchen/go-httpbin/v2 | < 2.18.0 | 2.18.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Httpbingo | Go-Httpbin | before 2.18.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-528q-4pgm-wvg2
- https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2
- https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04
- https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-45286