id: GO-2025-3554
modules:
    - module: github.com/mccutchen/go-httpbin
      vulnerable_at: 1.1.1
    - module: github.com/mccutchen/go-httpbin/v2
      versions:
        - fixed: 2.18.0
      vulnerable_at: 2.17.1
summary: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
ghsas:
    - GHSA-528q-4pgm-wvg2
references:
    - advisory: https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-528q-4pgm-wvg2
    - fix: https://github.com/mccutchen/go-httpbin/commit/0decfd1a2e88d85ca6bfb8a92421653f647cbc04
    - web: https://github.com/mccutchen/go-httpbin/releases/tag/v2.18.0
source:
    id: GHSA-528q-4pgm-wvg2
    created: 2025-03-25T12:07:11.327663-04:00
review_status: UNREVIEWED