PT-2025-13800 · Beego · Beego

Thevilledev · Published 2025-03-31 · Updated 2025-08-01 · CVE-2025-30223

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beego versions prior to 2.3.6

Description Beego is an open-source web framework for the Go programming language. A Cross-Site Scripting (XSS) vulnerability exists in the RenderForm() function due to improper HTML escaping of user-controlled data. This allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. The RenderForm() function generates an entire form markup and does not automatically escape attributes, creating a risk for injection attacks. The vulnerability is located in the renderFormField() function in templatefunc.go (around lines 316-356) where user-provided values are directly injected into HTML without proper escaping.

Recommendations Update Beego to version 2.3.6 or later.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-30223

GHSA-2J42-H78H-Q4FG

GO-2025-3585

OPENSUSE-SU-2025:14970-1

Affected Products

Beego

References · 27

• 🔥 https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30223.json · Exploit
• https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25 · Patch
• https://osv.dev/vulnerability/CVE-2025-30223 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14970-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30223 · Security Note
• https://osv.dev/vulnerability/GHSA-2j42-h78h-q4fg · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3585 · Vendor Advisory
• https://github.com/beego/beego · Note
• https://suse.com/security/cve/CVE-2025-29072 · Note
• https://twitter.com/CveFindCom/status/1906746099320111448 · Twitter Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ZBHJANMC5TN4MHLVGPYKJGT774IKFUQ3 · Note
• https://suse.com/security/cve/CVE-2025-31135 · Note
• https://twitter.com/VulmonFeeds/status/1906842311746548217 · Twitter Post
• https://t.me/cvedetector/21637 · Telegram Post