PT-2026-1070 · Mccutchen · Httpbin

Published 2025-03-21 · Updated 2026-01-02 · CVE-2025-45286

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mccutchen httpbin version 2.17.1

Description A cross-site scripting (XSS) issue exists in mccutchen httpbin. This allows attackers to execute arbitrary web scripts or HTML using a specially crafted payload. The vulnerability impacts the application's handling of user-supplied input, potentially enabling malicious code injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2025-45286

GHSA-528Q-4PGM-WVG2

GHSA-P4F6-H8JJ-VFVF

GO-2025-3554

Affected Products

Httpbin

References · 12

• 🔥 https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2 · Exploit
• https://osv.dev/vulnerability/GHSA-p4f6-h8jj-vfvf · Vendor Advisory
• https://github.com/advisories/GHSA-528q-4pgm-wvg2 · Patch
• https://osv.dev/vulnerability/GO-2025-3554 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-528q-4pgm-wvg2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-45286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45286 · Security Note
• https://github.com/mccutchen/go-httpbin · Note
• https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0 · Note
• https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04 · Note
• https://twitter.com/VulmonFeeds/status/2007172993835839923 · Twitter Post
• https://twitter.com/CVEnew/status/2007118445905948871 · Twitter Post