---
id: "CVE-2026-118652"
kind: "vulnerability"
aliases: ["CVE-2026-118652", "GHSA-h9g5-28mm-hx3g"]
title: "Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/labstack/echo/v5", "fixed": ["5.4.0"], "affected": "< 5.4.0", "ecosystem": "go"}, {"name": "github.com/labstack/echo/v4", "fixed": ["4.16.0"], "affected": "< 4.16.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["api-servers", "cwe-79", "echo", "go", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-jsonp-routes", "static-callback"]
published_at: "2026-10-28T19:54:05+00:00"
first_seen_at: "2026-10-28T19:56:29+00:00"
updated_at: "2026-10-28T19:56:38+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h9g5-28mm-hx3g", "first_seen_at": "2026-10-28T19:56:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118652", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo's Context.JSONP and Context.JSONPBlob write the caller-supplied callback name straight into the JavaScript response without validation. An attacker who gets a victim to open a crafted link runs arbitrary JavaScript in the site's origin, which can steal session cookies or act as the user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/labstack/echo/v5 affected < 5.4.0 fixed 5.4.0
- go:github.com/labstack/echo/v4 affected < 4.16.0 fixed 4.16.0

## How to check

- Run `go list -m github.com/labstack/echo/v4` or `go list -m github.com/labstack/echo/v5` and compare against `4.16.0` and `5.4.0`
- Search the codebase for `JSONP(` and `JSONPBlob(` calls that pass request input as the callback
- Check whether any JSONP route returns authenticated data

## Fix

- Upgrade echo v5 to `5.4.0` or echo v4 to `4.16.0`
- Until upgraded, validate the callback against `^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$` before calling JSONP
- Set `X-Content-Type-Options: nosniff` on JSONP responses
- Stop serving authenticated data through JSONP and use CORS with application/json instead

## Timeline

- 2026-10-28T19:56:29+00:00 ghsa https://github.com/advisories/GHSA-h9g5-28mm-hx3g
- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118652

## From the sources

### Summary

The `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callback` parameter into a JavaScript response **without any validation, escaping, or allow-listing**.  

This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback.

**Present in current master and v5.1.0 (latest release).**

### Vulnerable Code (verbatim)

```go
func (c *Context) jsonPBlob(code int, callback string, i any) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if err = c.echo.JSONSerializer.Serialize(c, i, ""); err != nil {
		return
	}
	if _, err = c.response.Write([]byte(");")); err != nil {
		return
	}
	return
}

func (c *Context) JSONP(code int, callback string, i any) (err error) {
	return c.jsonPBlob(code, callback, i)
}

func (c *Context) JSONPBlob(code int, callback string, b []byte) (err error) {
	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
	c.response.WriteHeader(code)
	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
		return
	}
	if _, err = c.response.Write(b); err != nil {
		return
	}
	_, err = c.response.Write([]byte(");"))
	return
}
```
No sanitization is performed on the callback string.

### Exploit (one-request repro)
Any route using the official pattern is vulnerable:
```
Goe.GET("/api", func(c echo.Context) error {
    return c.JSONP(200, c.QueryParam("callback"), map[string]string{"status": "ok"})
})
```
Attacker request:
```
GET /api?callback=alert(document.domain)%2f%2f HTTP/1.1
Host: target.com
```
Server response:
```
Content-Type: application/javascript; charset=utf-8

alert(document.domain)//({"status":"ok"});
```
→ Immediate arbitrary JavaScript execution (full reflected XSS).
### Impact

- Session hijacking, cookie theft, account takeover, keylogging, defacement.
- Works even with strict CSP (response is served as application/javascript).

#### Affected Versions

- All versions ≤ v5.1.0 (including current master)

#### Workarounds
Manually sanitize the callback before calling JSONP/JSONPBlob:
```
Gofunc safeCallback(cb string) string {
    if matched, _ := regexp.MatchString(`^[a-zA-Z0-9_.\[\]]+$`, cb); !matched {
        return "callback"
    }
    return cb
}
```
Or migrate away from JSONP entirely (use CORS + application/json).
### References

- https://github.com/labstack/echo/blob/master/context.go
- https://echo.labstack.com/docs/cookbook/jsonp

## Patches

Fixed in `github.com/labstack/echo/v5` v5.4.0 and `github.com/labstack/echo/v4` v4.16.0. `Context.JSONP` and `Context.JSONPBlob` accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, `_` and `$`); any other callback returns a 400 Bad Request error wrapping `ErrInvalidJSONPCallback` and nothing is written. JSONP responses also carry `X-Content-Type-Options: nosniff`.

## Workarounds

Validate the callback in your handler before calling `Context.JSONP`, for example against `^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$`, and set `X-Content-Type-Options: nosniff`. JSONP responses can be read by any website with the user's cookies, so do not serve data that requires authentication through JSONP.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_