XSS in Beego
CVE-2025-30223
Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (46.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Beego — versions < 2.3.6
Weakness classification (CWE)
References
- github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg (Exploit, Vendor Advisory)
- github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25 (Patch)
Frequently asked questions
- What is CVE-2025-30223?
- CVE-2025-30223 is a critical-severity vulnerability in Beego, classified under Cross-site Scripting. CVSS score: 9.3/10. Published 2025-03-31.
- How severe is CVE-2025-30223?
- Critical severity. CVSS v3 base score is 9.3 out of 10.