XSS in Labstack Echo
CVE-2026-118652
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.
Vulnerability class: XSS (Cross-Site Scripting)
Published .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Labstack Echo — versions < 4.16.0, >= 5.0.0, < 5.4.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-118652?
- CVE-2026-118652 is a medium-severity vulnerability in Labstack Echo, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-10-28.
- How severe is CVE-2026-118652?
- Medium severity. CVSS v3 base score is 6.1 out of 10.