Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

MITTEL 6.1CVE-2025-45286 · GHSA-528q-4pgm-wvg2 · GO-2025-3554 · Published 02/01/2026 · updated 04/11/2026

Kurz gesagt

CVE-2025-45286 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in github.com/mccutchen/go-httpbin, github.com/mccutchen/go-httpbin/v2, go-httpbin (httpbingo).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.27%, höher als bei 18.9% aller Schwachstellen.
Abhilfe: auf 2.18.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/mccutchen/go-httpbin Go	`< 2.18.0all versions`	`2.18.0`
github.com/mccutchen/go-httpbin/v2 Go	`< 2.18.0`	`2.18.0`
go-httpbin httpbingo	`< 2.18.0`	`2.18.0`

Description

The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.

Affected URLs:

/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E
/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html
/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html

Steps to reproduce:

Visit one of the above mentioned URLs.
XSS window will popup

Suggested fix

Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers

Criticality

The following can be major impacts of the issue:

Access to victim's sensitive Personal Identifiable Information.
Access to CSRF token
Cookie injection
Phishing
And any other thing Javascript can perform

NVD description

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

References

mccutchen/go-httpbin security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-45286 · ADVISORY
mccutchen/go-httpbin commit 0decfd1 · WEB
mccutchen/go-httpbin · PACKAGE
mccutchen/go-httpbin release v2.18.0 · WEB
GitHub Advisory GHSA-528q-4pgm-wvg2 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2025-45286 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in github.com/mccutchen/go-httpbin, github.com/mccutchen/go-httpbin/v2, go-httpbin (httpbingo).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.27%, höher als bei 18.9% aller Schwachstellen.

Abhilfe: auf 2.18.0 oder neuer aktualisieren.

Package

Affected versions

Patched versions

github.com/mccutchen/go-httpbin

< 2.18.0all versions

2.18.0

github.com/mccutchen/go-httpbin/v2

< 2.18.0

2.18.0

go-httpbin

httpbingo

< 2.18.0

2.18.0

Description

The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.

Affected URLs:

/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E
/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html
/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html

Steps to reproduce:

Visit one of the above mentioned URLs.
XSS window will popup

Suggested fix

Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers

Criticality

The following can be major impacts of the issue:

Access to victim's sensitive Personal Identifiable Information.
Access to CSRF token
Cookie injection
Phishing
And any other thing Javascript can perform

NVD description

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.