CVE-2026-118652: Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
Summary
The Context.JSONP, Context.JSONPBlob, and internal jsonPBlob helper in context.go directly concatenate the caller-supplied callback parameter into a JavaScript response without any validation, escaping, or allow-listing.
This creates a high-impact reflected XSS that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.
Present in current master and v5.1.0 (latest release).
Vulnerable Code (verbatim)
go func (c Context) jsonPBlob(code int, callback string, i any) (err error) { c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8) c.response.WriteHeader(code) if , err = c.response.Write([]byte(callback + "(")); err != nil { return } if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil { return } if , err = c.response.Write([]byte(");")); err != nil { return } return }
func (c Context) JSONP(code int, callback string, i any) (err error) { return c.jsonPBlob(code, callback, i) }
func (c Context) JSONPBlob(code int, callback string, b []byte) (err error) { c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8) c.response.WriteHeader(code) if , err = c.response.Write([]byte(callback + "(")); err != nil { return } if , err = c.response.Write(b); err != nil { return } , err = c.response.Write([]byte(");")) return } No sanitization is performed on the callback string.
Exploit (one-request repro) Any route using the official pattern is vulnerable: Goe.GET("/api", func(c echo.Context) error { return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"}) }) Attacker request: GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1 Host: target.com Server response: Content-Type: application/javascript; charset=utf-8
alert(document.domain)//({"status":"ok"}); → Immediate arbitrary JavaScript execution (full reflected XSS). Impact
- Session hijacking, cookie theft, account takeover, keylogging, defacement. - Works even with strict CSP (response is served as application/javascript).
Affected Versions
- All versions ≤ v5.1.0 (including current master)
Workarounds Manually sanitize the callback before calling JSONP/JSONPBlob: Gofunc safeCallback(cb string) string { if matched, := regexp.MatchString(^[a-zA-Z0-9.\[\]]+$, cb); !matched { return "callback" } return cb } Or migrate away from JSONP entirely (use CORS + application/json). References
- https://github.com/labstack/echo/blob/master/context.go - https://echo.labstack.com/docs/cookbook/jsonp
Patches
Fixed in github.com/labstack/echo/v5 v5.4.0 and github.com/labstack/echo/v4 v4.16.0. Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, and $); any other callback returns a 400 Bad Request error wrapping ErrInvalidJSONPCallback and nothing is written. JSONP responses also carry X-Content-Type-Options: nosniff.
Workarounds
Validate the callback in your handler before calling Context.JSONP, for example against ^[A-Za-z$][A-Za-z0-9$](\.[A-Za-z$][A-Za-z0-9$])$, and set X-Content-Type-Options: nosniff. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.
Other sources
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/labstack/echo/v4to a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
go/github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.0 - Upgrade
Upgrade
github.com/labstack/echo/v4to a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.0 - Configuration
Validate the callback against the specified identifier or dot-separated identifier pattern before calling JSONP or JSONPBlob; reject invalid callbacks.
Echo Context.JSONP / Context.JSONPBlob callback validation = ^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$ - Configuration
Migrate away from JSONP entirely and use CORS with application/json instead.
Application JSONP responses JSONP usage = disabled - Configuration
Set the X-Content-Type-Options response header to nosniff for JSONP responses.
JSONP responses X-Content-Type-Options = nosniff - Compensating control
Do not serve data that requires authentication through JSONP, because JSONP responses can be read by any website with the user's cookies.
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Only applications with a route that passes attacker-controlled input to Context.JSONP or Context.JSONPBlob are exposed. The issue is not exploitable solely because the framework is present; an attacker must be able to influence the callback argument.
What does an attacker need to do to exploit this issue?
An attacker needs to craft a callback value that produces executable JavaScript syntax and induce a user to load the resulting response. No attacker privileges are required, but user interaction is required.
What versions resolve the issue?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions prior to those releases are affected when application routes expose attacker control over the callback argument.
What can be done before upgrading?
Do not pass untrusted request input directly as the callback argument to Context.JSONP or Context.JSONPBlob. Restrict callback values to an application-controlled allowlist or otherwise validate them before use.