Duplicate Advisory: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type
Date: 2026-01
Affected: go/github.com/mccutchen/go-httpbin, go/github.com/mccutchen/go-httpbin/v2
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-79

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-528q-4pgm-wvg2. This link is maintained to preserve external references. ### Original Description A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.


Mitigations:

Architectural layers (MAESTRO):