Vulnerability-Lookup

GHSA-QJV7-627W-8QJV

Vulnerability from github – Published: 2026-05-05 20:13 – Updated: 2026-05-13 14:20

Summary

Fiber vulnerable to XSS in AutoFormat Content Negotiation

Details

Summary

Description

A Cross-Site Scripting (CWE-79) vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. This affects github.com/gofiber/fiber/v3 (DefaultRes.AutoFormat) through version 3.1.0 and github.com/gofiber/fiber/v2 (Ctx.Format) through version 2.52.12.

The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. Five of the six branches of the same method already escape. JSON, XML, MsgPack, and CBOR all route through encoders that neutralize markup; the txt branch emits text/plain and cannot execute. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply."

Details

The "html" branch concatenates the stringified body directly into HTML markup with no output encoding: - accept comes from r.c.Accepts(...), i.e. is fully attacker-controlled. An attacker can force the "html" branch on any AutoFormat() call regardless of which format the developer tested against. - b is produced from body via direct assignment (string / []byte) or fmt.Sprintf("%v", body). No html.EscapeString is applied. - The resulting string is sent as text/html; charset=utf-8, so browsers render it as active HTML.

// res.go
func (r *DefaultRes) AutoFormat(body any) error {

    accept := r.c.DefaultReq.Accepts("html", "json", "txt", "xml", "msgpack", "cbor")

    r.Type(accept)
    var b string
    switch val := body.(type) {
    case string:
        b = val
    case []byte:
        b = r.c.app.toString(val)
    default:
        b = fmt.Sprintf("%v", val)
    }

    switch accept {
    case "txt":
        return r.SendString(b)
    case "json":
        return r.JSON(body)
    case "xml":
        return r.XML(body)
    case "html":
        return r.SendString("<p>" + b + "</p>")
    case "msgpack":
        return r.MsgPack(body)
    case "cbor":
        return r.CBOR(body)
    }
    return r.SendString(b)
}

Impact

This impacts all current v3 releases ≤ 3.1.0 containing DefaultRes.AutoFormat, and all current v2 releases ≤ 2.52.12 where the identical "<p>" + b + "</p>" construction exists in (*Ctx).Format(). Exploitation requires that an application call c.AutoFormat(v) where v (or a field stringified by %v) contains request-influenced data.

A handler that uses AutoFormat() to serve multiple representations of the same data can be turned into an HTML XSS sink when the client sends Accept: text/html, even if the developer only tested the JSON path.

This may result in: - Reflected XSS in the application's origin via any request-derived value reaching AutoFormat. - Stored XSS where the reflected value originates from persisted input later passed to AutoFormat.

Proposed Patch

The injection surface is r.Type("html") followed by r.SendString(b) with unescaped caller data, where it constructs markup on the caller's behalf around a value whose HTML-ness the caller did not declare. A few options: - AutoFormat() should treat body as data, not markup, in the "html" branch and escape it before concatenating it into the framework-generated <p> wrapper. Callers that need raw negotiated HTML should use Format() with an explicit HTML handler. - Introduce a sibling method that escapes, leave AutoFormat alone for backward compatibility.

HTML-escape the value in the "html" branch before concatenating it into the <p> wrapper.

import "html"

// ...
case "html":
    return r.SendString("<p>" + html.EscapeString(b) + "</p>")

html.EscapeString escapes <, >, &, ', ", which is sufficient for an element-text context. Apply the same change to v2's (*Ctx).Format().

Proof of Concept

# Create project directory
mkdir fiber-xss-poc && cd fiber-xss-poc

# Initialize Go module
go mod init fiber-xss-poc

# Install Fiber v3
go get github.com/gofiber/fiber/v3

# Create the PoC file
cat > main.go << 'EOF'
package main

import (
    "github.com/gofiber/fiber/v3"
)

type User struct {
    ID   int    `json:"id"`
    Name string `json:"name"`
}

func main() {
    app := fiber.New()

    app.Get("/api/user", func(c fiber.Ctx) error {
        user := User{
            ID:   1,
            Name: c.Query("name", "anonymous"),
        }
        return c.AutoFormat(user)
    })

    app.Listen(":3000")
}
EOF

# Run it
go run main.go
}

Benign JSON

curl -s 'http://127.0.0.1:3000/api/user?name=Alice' -H 'Accept: application/json'
{"id":1,"name":"Alice"}

HTML sink enables XSS

curl -s 'http://127.0.0.1:3000/api/user?name=<script>alert(document.domain)</script>' -H 'Accept: text/html'
<p>{1 <script>alert(document.domain)</script>}</p>

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gofiber/fiber/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.52.12"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gofiber/fiber/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T20:13:23Z",
    "nvd_published_at": "2026-05-11T23:19:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n**Description**\n\nA Cross-Site Scripting (CWE-79) vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying `Accept: text/html` on any request whose handler passes attacker-influenced data to the AutoFormat() feature. This affects `github.com/gofiber/fiber/v3` (`DefaultRes.AutoFormat`) through version 3.1.0 and `github.com/gofiber/fiber/v2` (`Ctx.Format`) through version 2.52.12. \n\nThe developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. Five of the six branches of the same method already escape. `JSON`, `XML`, `MsgPack`, and `CBOR` all route through encoders that neutralize markup; the txt branch emits `text/plain` and cannot execute. The html branch is the sole outlier in a method whose name (`AutoFormat`) and symmetrical structure actively telegraph \"safe, format-agnostic reply.\"\n\n## Details\nThe issue resides in `res.go` within `(*DefaultRes).AutoFormat()`. The method negotiates against the request Accept header, selects one of `html | json | txt | xml | msgpack | cbor`, and serializes the caller-supplied body accordingly.\n\nThe \"html\" branch concatenates the stringified body directly into HTML markup with no output encoding:\n- `accept` comes from `r.c.Accepts(...)`, i.e. is fully attacker-controlled. An attacker can force the \"html\" branch on any `AutoFormat()` call regardless of which format the developer tested against.\n- `b` is produced from `body` via direct assignment (`string` / `[]byte`) or `fmt.Sprintf(\"%v\", body)`. No `html.EscapeString` is applied.\n- The resulting string is sent as `text/html; charset=utf-8`, so browsers render it as active HTML.\n\n```go\n// res.go\nfunc (r *DefaultRes) AutoFormat(body any) error {\n\n    accept := r.c.DefaultReq.Accepts(\"html\", \"json\", \"txt\", \"xml\", \"msgpack\", \"cbor\")\n\n    r.Type(accept)\n    var b string\n    switch val := body.(type) {\n    case string:\n        b = val\n    case []byte:\n        b = r.c.app.toString(val)\n    default:\n        b = fmt.Sprintf(\"%v\", val)\n    }\n\n    switch accept {\n    case \"txt\":\n        return r.SendString(b)\n    case \"json\":\n        return r.JSON(body)\n    case \"xml\":\n        return r.XML(body)\n    case \"html\":\n        return r.SendString(\"\u003cp\u003e\" + b + \"\u003c/p\u003e\")\n    case \"msgpack\":\n        return r.MsgPack(body)\n    case \"cbor\":\n        return r.CBOR(body)\n    }\n    return r.SendString(b)\n}\n```\n## Impact\n\nThis impacts all current v3 releases \u2264 3.1.0 containing `DefaultRes.AutoFormat`, and all current v2 releases \u2264 2.52.12 where the identical `\"\u003cp\u003e\" + b + \"\u003c/p\u003e\"` construction exists in `(*Ctx).Format()`. Exploitation requires that an application call `c.AutoFormat(v)` where `v` (or a field stringified by `%v`) contains request-influenced data.\n\nA handler that uses `AutoFormat()` to serve multiple representations of the same data can be turned into an HTML XSS sink when the client sends `Accept: text/html`, even if the developer only tested the JSON path.\n\nThis may result in:\n- **Reflected XSS** in the application\u0027s origin via any request-derived value reaching `AutoFormat`.\n- **Stored XSS** where the reflected value originates from persisted input later passed to `AutoFormat`.\n\n## Proposed Patch\n\nThe injection surface is `r.Type(\"html\")` followed by `r.SendString(b)` with unescaped caller data, where it constructs markup on the caller\u0027s behalf around a value whose HTML-ness the caller did not declare. A few options:\n- `AutoFormat()` should treat `body` as data, not markup, in the `\"html\"` branch and escape it before concatenating it into the framework-generated `\u003cp\u003e` wrapper. Callers that need raw negotiated HTML should use `Format()` with an explicit HTML handler.\n- Introduce a sibling method that escapes, leave `AutoFormat` alone for backward compatibility.\n\nHTML-escape the value in the \"html\" branch before concatenating it into the `\u003cp\u003e` wrapper.\n```go\nimport \"html\"\n\n// ...\ncase \"html\":\n    return r.SendString(\"\u003cp\u003e\" + html.EscapeString(b) + \"\u003c/p\u003e\")\n```\n\n`html.EscapeString` escapes `\u003c`, `\u003e`, `\u0026`, `\u0027`, `\"`, which is sufficient for an element-text context. Apply the same change to v2\u0027s `(*Ctx).Format()`.\n\n## Proof of Concept\n\n```bash\n# Create project directory\nmkdir fiber-xss-poc \u0026\u0026 cd fiber-xss-poc\n\n# Initialize Go module\ngo mod init fiber-xss-poc\n\n# Install Fiber v3\ngo get github.com/gofiber/fiber/v3\n\n# Create the PoC file\ncat \u003e main.go \u003c\u003c \u0027EOF\u0027\npackage main\n\nimport (\n\t\"github.com/gofiber/fiber/v3\"\n)\n\ntype User struct {\n\tID   int    `json:\"id\"`\n\tName string `json:\"name\"`\n}\n\nfunc main() {\n\tapp := fiber.New()\n\t\n\tapp.Get(\"/api/user\", func(c fiber.Ctx) error {\n\t\tuser := User{\n\t\t\tID:   1,\n\t\t\tName: c.Query(\"name\", \"anonymous\"),\n\t\t}\n\t\treturn c.AutoFormat(user)\n\t})\n\n\tapp.Listen(\":3000\")\n}\nEOF\n\n# Run it\ngo run main.go\n}\n```\n\nBenign JSON\n```bash\ncurl -s \u0027http://127.0.0.1:3000/api/user?name=Alice\u0027 -H \u0027Accept: application/json\u0027\n{\"id\":1,\"name\":\"Alice\"}\n```\n\nHTML sink enables XSS\n```bash\ncurl -s \u0027http://127.0.0.1:3000/api/user?name=\u003cscript\u003ealert(document.domain)\u003c/script\u003e\u0027 -H \u0027Accept: text/html\u0027\n\u003cp\u003e{1 \u003cscript\u003ealert(document.domain)\u003c/script\u003e}\u003c/p\u003e\n```",
  "id": "GHSA-qjv7-627w-8qjv",
  "modified": "2026-05-13T14:20:14Z",
  "published": "2026-05-05T20:13:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42554"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gofiber/fiber"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fiber vulnerable to XSS in AutoFormat Content Negotiation"
}

CVE-2026-42554 (GCVE-0-2026-42554)

Vulnerability from cvelistv5 – Published: 2026-05-11 21:47 – Updated: 2026-05-15 18:24

Title

Fiber: XSS in AutoFormat Content Negotiation

Summary

Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/gofiber/fiber/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
gofiber	fiber	Affected: < 2.52.13 Affected: >= 3.0.0-beta.2, < 3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42554",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T18:24:24.733312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T18:24:38.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fiber",
          "vendor": "gofiber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.52.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta.2, \u003c 3.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph \"safe, format-agnostic reply.\" This vulnerability is fixed in 2.52.12 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:47:17.133Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv"
        }
      ],
      "source": {
        "advisory": "GHSA-qjv7-627w-8qjv",
        "discovery": "UNKNOWN"
      },
      "title": "Fiber: XSS in AutoFormat Content Negotiation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42554",
    "datePublished": "2026-05-11T21:47:17.133Z",
    "dateReserved": "2026-04-28T16:56:50.191Z",
    "dateUpdated": "2026-05-15T18:24:38.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-QJV7-627W-8QJV

Summary

Details

Impact

Proposed Patch

Proof of Concept

CVE-2026-42554 (GCVE-0-2026-42554)

Tags

Sightings

Nomenclature