{"id":"CVE-2025-45286","aliases":["EUVD-2025-7205","GHSA-528q-4pgm-wvg2","GO-2025-3554"],"status":"published","title":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","description":"A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00267,"percentile":0.19032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2025-03-21T22:29:47Z","modified":"2026-11-04T22:10:00Z","fixes":[{"ecosystem":"Go","package":"github.com/mccutchen/go-httpbin","fixed_in":["2.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/mccutchen/go-httpbin/v2","fixed_in":["2.18.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.18.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.18.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mccutchen/go-httpbin/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.18.0"}]}]}],"products":[{"vendor":"httpbingo","product":"go-httpbin"}],"references":[{"url":"https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2","tags":["exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/advisories/GHSA-528q-4pgm-wvg2","tags":["Patch","Third Party Advisory","advisory"]},{"url":"https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04","tags":["web","fix"]},{"url":"https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45286","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45286.json","tags":["advisory"]},{"url":"https://github.com/mccutchen/go-httpbin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-45286","description":"A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-01-06T17:37:47.062Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-7205","description":"A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-01-06T17:37:47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:55.49901Z"}],"ghsa":[{"id":"GHSA-528q-4pgm-wvg2","title":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","description":"### Description\n\nThe go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser.\n\n### Affected URLs:\n- `/response-headers?Content-Type=text/html\u0026xss=%3Cimg/src/onerror=alert(%27xss%27)%3E`\n- `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n- `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n\n### Steps to reproduce:\n1. Visit one of the above mentioned URLs.\n2. XSS window will popup\n\n### Suggested fix\n- Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers\n\n\n### Criticality\nThe following can be major impacts of the issue:\n* Access to victim's sensitive Personal Identifiable Information.\n* Access to CSRF token\n* Cookie injection\n* Phishing\n* And any other thing Javascript can perform","status":"published","published":"2025-03-21T22:29:47Z","modified":"2026-01-02T20:32:36Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:15.106458Z"}],"nvd":[{"id":"CVE-2025-45286","description":"A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"published","published":"2026-01-02T15:15:59.903Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-80"],"updated_at":"2026-11-04T23:43:38.567042Z"}],"osv":[{"id":"CVE-2025-45286","description":"A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-11-05T21:16:11.00554448Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"GHSA-528q-4pgm-wvg2","title":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","description":"### Description\n\nThe go-httpbin framework is vulnerable to XSS as the user can control the `Response Content-Type` from GET parameter. This allows attacker to execute cross site scripts in victims browser.\n\n### Affected URLs:\n- `/response-headers?Content-Type=text/html\u0026xss=%3Cimg/src/onerror=alert(%27xss%27)%3E`\n- `/base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n- `/base64/decode/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html`\n\n### Steps to reproduce:\n1. Visit one of the above mentioned URLs.\n2. XSS window will popup\n\n### Suggested fix\n- Allow Only Safe Content-Type Values Or give users option to define whitelisted Content-Type headers\n\n\n### Criticality\nThe following can be major impacts of the issue:\n* Access to victim's sensitive Personal Identifiable Information.\n* Access to CSRF token\n* Cookie injection\n* Phishing\n* And any other thing Javascript can perform","status":"published","published":"2025-03-21T22:29:47Z","modified":"2026-07-08T07:14:02.850946617Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"GO-2025-3554","title":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin","description":"Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin","status":"published","published":"2025-03-25T19:38:11Z","modified":"2026-03-03T04:56:26.142198Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}