{"id":"CVE-2025-45286","aliases":["GHSA-528q-4pgm-wvg2","GO-2025-3554"],"title":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","summary":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","severity":"low","vendor":"mccutchen","product":"github.com/mccutchen/go-httpbin","ecosystem":"go","affected":["github.com/mccutchen/go-httpbin < 2.18.0","github.com/mccutchen/go-httpbin/v2 < 2.18.0"],"patched":["github.com/mccutchen/go-httpbin 2.18.0","github.com/mccutchen/go-httpbin/v2 2.18.0"],"published":"2025-03-21","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-528q-4pgm-wvg2","references":[{"url":"https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45286"},{"url":"https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04"},{"url":"https://github.com/mccutchen/go-httpbin"},{"url":"https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0"}],"tags":["osv","go"],"epss":0.00271,"epssPercentile":0.1954,"ingestedAt":"2026-07-09T18:56:35.908Z","slug":"CVE-2025-45286","body":"## Overview\n\n### Description\n\nThe go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser.\n\n### Affected URLs:\n- `/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E`\n- `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n- `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n\n### Steps to reproduce:\n1. Visit one of the above mentioned URLs.\n2. XSS window will popup\n\n### Suggested fix\n- Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers\n\n\n### Criticality\nThe following can be major impacts of the issue:\n* Access to victim's sensitive Personal Identifiable Information.\n* Access to CSRF token\n* Cookie injection\n* Phishing\n* And any other thing Javascript can perform\n\n## Affected packages\n\n- `github.com/mccutchen/go-httpbin < 2.18.0`\n- `github.com/mccutchen/go-httpbin/v2 < 2.18.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/mccutchen/go-httpbin 2.18.0`\n- `github.com/mccutchen/go-httpbin/v2 2.18.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}