CVE-2025-45286Low▾ SunlitReflected XSS in go-httpbin due to unrestricted client control over Content-Type
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.3%
The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser.
/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/htmlThe following can be major impacts of the issue:
github.com/mccutchen/go-httpbin < 2.18.0github.com/mccutchen/go-httpbin/v2 < 2.18.0Upgrade to a patched release:
github.com/mccutchen/go-httpbin 2.18.0github.com/mccutchen/go-httpbin/v2 2.18.0