---
id: CVE-2026-118652
aliases:
  - GHSA-h9g5-28mm-hx3g
title: >-
  Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP
  callback in Context.JSONP / Context.JSONPBlob
summary: >-
  Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP
  callback in Context.JSONP / Context.JSONPBlob
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: labstack
product: github.com/labstack/echo/v5
ecosystem: go
affected:
  - github.com/labstack/echo/v5 < 5.4.0
  - github.com/labstack/echo/v4 < 4.16.0
patched:
  - github.com/labstack/echo/v5 5.4.0
  - github.com/labstack/echo/v4 4.16.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T20:15:05.451169812Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h9g5-28mm-hx3g'
references:
  - url: 'https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g'
  - url: >-
      https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
  - url: >-
      https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
  - url: 'https://github.com/labstack/echo'
  - url: 'https://github.com/labstack/echo/releases/tag/v4.16.0'
  - url: 'https://github.com/labstack/echo/releases/tag/v5.4.0'
  - url: 'https://github.com/advisories/GHSA-h9g5-28mm-hx3g'
tags:
  - osv
  - go
  - ghsa
epss: 0.00239
epssPercentile: 0.15025
cwe:
  - CWE-79
ingestedAt: '2026-10-28T20:17:49.703Z'
---

## Overview

### Summary

The `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callback` parameter into a JavaScript response **without any validation, escaping, or allow-listing**.  

This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.

**Present in current master and v5.1.0 (latest release).**

### Vulnerable Code (verbatim)

```go
func (c *Context) jsonPBlob(code int, callback string, i any) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil {
		return
	}
	if _, err = c.response.Write([]byte(");")); err != nil {
		return
	}
	return
}

func (c *Context) JSONP(code int, callback string, i any) (err error) {
	return c.jsonPBlob(code, callback, i)
}

func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if _, err = c.response.Write(b); err != nil {
		return
	}
	_, err = c.response.Write([]byte(");"))
	return
}
```
No sanitization is performed on the callback string.

### Exploit (one-request repro)
Any route using the official pattern is vulnerable:
```
Goe.GET("/api", func(c echo.Context) error {
    return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"})
})
```
Attacker request:
```
GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1
Host: target.com
```
Server response:
```
Content-Type: application/javascript; charset=utf-8

alert(document.domain)//({"status":"ok"});
```
→ Immediate arbitrary JavaScript execution (full reflected XSS).
### Impact

- Session hijacking, cookie theft, account takeover, keylogging, defacement.
- Works even with strict CSP (response is served as application/javascript).

#### Affected Versions

- All versions ≤ v5.1.0 (including current master)

#### Workarounds
Manually sanitize the callback before calling JSONP/JSONPBlob:
```
Gofunc safeCallback(cb string) string {
    if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\[\]]+$`, cb); !matched {
        return "callback"
    }
    return cb
}
```
Or migrate away from JSONP entirely (use CORS + application/json).
### References

- https://github.com/labstack/echo/blob/master/context.go
- https://echo.labstack.com/docs/cookbook/jsonp

## Patches

Fixed in `github.com/labstack/echo/v5` v5.4.0 and `github.com/labstack/echo/v4` v4.16.0. `Context.JSONP` and `Context.JSONPBlob` accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, `_` and `$`); any other callback returns a 400 Bad Request error wrapping `ErrInvalidJSONPCallback` and nothing is written. JSONP responses also carry `X-Content-Type-Options: nosniff`.

## Workarounds

Validate the callback in your handler before calling `Context.JSONP`, for example against `^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$`, and set `X-Content-Type-Options: nosniff`. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.

## Affected packages

- `github.com/labstack/echo/v5 < 5.4.0`
- `github.com/labstack/echo/v4 < 4.16.0`

## Remediation

Upgrade to a patched release:

- `github.com/labstack/echo/v5 5.4.0`
- `github.com/labstack/echo/v4 4.16.0`