A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
References
| Link | Resource |
|---|---|
| https://github.com/advisories/GHSA-528q-4pgm-wvg2 | Third Party Advisory Patch |
| https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2 | Vendor Advisory |
| https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2 | Vendor Advisory |
Configurations
History
07 Jan 2026, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/advisories/GHSA-528q-4pgm-wvg2 - Third Party Advisory, Patch | |
| References | () https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2 - Vendor Advisory | |
| CPE | cpe:2.3:a:httpbingo:go-httpbin:*:*:*:*:*:go:*:* | |
| First Time |
Httpbingo go-httpbin
Httpbingo |
06 Jan 2026, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-80 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2 - |
02 Jan 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-02 15:15
Updated : 2026-01-07 17:25
NVD link : CVE-2025-45286
Mitre link : CVE-2025-45286
CVE.ORG link : CVE-2025-45286
JSON object : View
Products Affected
httpbingo
- go-httpbin
CWE
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)