PT-2026-40911 · Stefanprodan · Podinfo

Niccolo Parlanti + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-43644

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43644

Affected Products

Podinfo

References · 4

• 🔥 https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43644 · Security Note
• https://github.com/stefanprodan/podinfo/issues/474 · Note
• https://vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint · Note