---
id: CVE-2025-45286
aliases:
  - GHSA-528q-4pgm-wvg2
  - GO-2025-3554
title: >-
  Reflected XSS in go-httpbin due to unrestricted client control over
  Content-Type
summary: >-
  Reflected XSS in go-httpbin due to unrestricted client control over
  Content-Type
severity: low
vendor: mccutchen
product: github.com/mccutchen/go-httpbin
ecosystem: go
affected:
  - github.com/mccutchen/go-httpbin < 2.18.0
  - github.com/mccutchen/go-httpbin/v2 < 2.18.0
patched:
  - github.com/mccutchen/go-httpbin 2.18.0
  - github.com/mccutchen/go-httpbin/v2 2.18.0
published: '2025-03-21'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-528q-4pgm-wvg2'
references:
  - url: >-
      https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-45286'
  - url: >-
      https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04
  - url: 'https://github.com/mccutchen/go-httpbin'
  - url: 'https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0'
tags:
  - osv
  - go
epss: 0.00271
epssPercentile: 0.19582
ingestedAt: '2026-07-09T18:56:35.908Z'
---

## Overview

### Description

The go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser.

### Affected URLs:
- `/response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E`
- `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`
- `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`

### Steps to reproduce:
1. Visit one of the above mentioned URLs.
2. XSS window will popup

### Suggested fix
- Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers


### Criticality
The following can be major impacts of the issue:
* Access to victim's sensitive Personal Identifiable Information.
* Access to CSRF token
* Cookie injection
* Phishing
* And any other thing Javascript can perform

## Affected packages

- `github.com/mccutchen/go-httpbin < 2.18.0`
- `github.com/mccutchen/go-httpbin/v2 < 2.18.0`

## Remediation

Upgrade to a patched release:

- `github.com/mccutchen/go-httpbin 2.18.0`
- `github.com/mccutchen/go-httpbin/v2 2.18.0`