Listen to this Post
The vulnerability is a reflected cross-site scripting (XSS) issue in go-httpbin version 2.17.1, caused by unrestricted client control over the Content-Type header. When a user sends an HTTP request to the go-httpbin server, the application echoes back request details in the response HTML for debugging. Specifically, the Content-Type header value from the client request is directly reflected in the server’s response without proper sanitization or encoding. An attacker can craft a malicious request with a Content-Type header containing JavaScript code, such as “text/html;“. If a victim is tricked into submitting this crafted request, either via a malicious link or form, the malicious script is injected into the response and executed in the victim’s browser. This occurs because the server fails to validate or escape user-supplied input in the Content-Type parameter before including it in the HTML output. The attack relies on social engineering, as the victim must interact with the attacker’s payload. The severity is low due to the required user interaction and the typical use of go-httpbin as a testing tool with limited sensitive data exposure. However, if deployed in a production environment, it could lead to arbitrary script execution, potentially compromising user sessions or stealing cookies. The vulnerability stems from inadequate input handling and output encoding practices. The duplicate advisory GHSA-528q-4pgm-wvg2 indicates this issue was previously identified, suggesting patches or workarounds exist to mitigate the risk by enforcing strict content-type validation or implementing proper escaping mechanisms.
Platform: go-httpbin
Version: v2.17.1
Vulnerability: Reflected XSS
Severity: Low
Date: Jan 2, 2026
Prediction: Patch not specified
What Undercode Say:
Analytics
curl -H “Content-Type: ” http://localhost:8080/headers
docker run -p 8080:8080 mccutchen/httpbin:2.17.1
How Exploit:
Craft malicious URL.
Trick user click.
Script executes browser.
Protection from this CVE
Validate Content-Type header.
Escape output data.
Update to patched version.
Impact:
Arbitrary script execution.
Session hijacking possible.
Low risk environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
