Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines

HIGH 7.5CVE-2020-36567 · GHSA-6vm3-jj99-7229 · GO-2020-0001 · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2020-36567 is a HIGH (CVSS 7.5) vulnerability affecting github.com/gin-gonic/gin, gin (gin-gonic).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.1% of all vulnerabilities.
Fix: update to 1.6.0 or later.

Package	Affected versions	Patched versions
github.com/gin-gonic/gin Go	`< 1.6.0`	`1.6.0`
gin gin-gonic	`< 1.6.0`	`1.6.0`

Description

Gin is a HTTP web framework written in Go (Golang). Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

NVD description

Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

References

nvd.nist.gov/vuln/detail/CVE-2020-36567 · ADVISORY
gin-gonic/gin#2237 · WEB
gin-gonic/gin commit a71af9c · WEB
gin-gonic/gin · PACKAGE
pkg.go.dev/vuln/GO-2020-0001 · WEB

More vulnerabilities in github.com/gin-gonic/gin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/gin-gonic/gin

< 1.6.0

1.6.0

gin

gin-gonic

< 1.6.0

1.6.0

Description

Gin is a HTTP web framework written in Go (Golang). Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

NVD description

Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

More vulnerabilities in github.com/gin-gonic/gin

See all →