CVE-2026-118652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-118652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-118652
Aliases
Downstream
Published
2026-10-28T19:35:47Z
Modified
2026-10-29T10:45:53Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
Details

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118652.json"
}
References

Affected packages

Git / github.com/labstack/echo

Affected ranges

Type
GIT
Repo
https://github.com/labstack/echo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e75c6c6d0c99602336fcf2c6bf6c8475ee160683
Introduced
9500f2745481e2dff1313e2e6734c488e80c13fb
Fixed
fc410094b2f3415cf2bf5204082137b205bfd5af
Fixed
b838391e2eade87ae7e5a09d7bb5087bec271ec1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4.16.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "fixed":  "5.4.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "b838391e2eade87ae7e5a09d7bb5087bec271ec1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "fc410094b2f3415cf2bf5204082137b205bfd5af"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v4.16.0",
            "range":  [
                {
                    "fixed":  "e75c6c6d0c99602336fcf2c6bf6c8475ee160683"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v5.4.0",
            "range":  [
                {
                    "fixed":  "fc410094b2f3415cf2bf5204082137b205bfd5af"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.0.0-alpha
3.*
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
v0.*
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.2
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3
v2.*
v2.0.0
v2.0.0-apha.1
v2.0.0-apha.2
v2.0.0-apha1
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.1
v2.0.2
v3.*
v3.0.0
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.0-rc.1
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.3.0
v3.3.1
v3.3.10
v3.3.2
v3.3.3
v3.3.4
v3.3.5-retag
v3.3.6-retag
v3.3.7-retag
v3.3.8-retag
v3.3.9
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.10.0
v4.10.1
v4.10.2
v4.11.0
v4.11.1
v4.11.2
v4.11.3
v4.11.4
v4.12.0
v4.13.0
v4.13.1
v4.13.2
v4.13.3
v4.13.4
v4.14.0
v4.15.0
v4.15.1
v4.15.2
v4.15.3
v4.15.4
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.7.2
v4.8.0
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.1.0
v5.1.1
v5.2.0
v5.2.1
v5.3.0
v5.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118652.json"