PT-2026-42363 · Go · Github.Com/Stefanprodan/Podinfo

Published 2026-05-14 · Updated 2026-05-14

OSV

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-Q23M-VM9R-5745

Affected Products

Github.Com/Stefanprodan/Podinfo

References · 9

• 🔥 https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43644 · Security Note
• https://osv.dev/vulnerability/GHSA-q23m-vm9r-5745 · Vendor Advisory
• https://github.com/stefanprodan/podinfo · Note
• https://github.com/stefanprodan/podinfo/commit/cbebb20fd48588d36fc7ff3e874c128eb89692f4 · Note
• https://github.com/stefanprodan/podinfo/pull/480 · Note
• https://github.com/stefanprodan/podinfo/releases/tag/6.12.0 · Note
• https://github.com/stefanprodan/podinfo/issues/474 · Note
• https://vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint · Note