UBUNTU-CVE-2026-118652: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0
Frequently Asked Questions
Which applications are exposed to exploitation?
Only applications using affected Echo versions that have a route passing attacker-controlled input to Context.JSONP or Context.JSONPBlob as the callback are exposed. The vulnerable behavior is not exploitable solely because Echo is present.
What does an attacker need to exploit this issue?
An attacker needs to control the callback value used by an application route and induce a user to load the crafted JSONP response. No authentication is required, but user interaction is required.
Are default deployments affected?
A default deployment is not necessarily exploitable. Exploitation depends on application-specific use of Context.JSONP or Context.JSONPBlob with an attacker-controlled callback argument.
What versions contain the fix?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions prior to those releases are affected when the application exposes attacker control over the callback value.