CVE-2025-30223 Details
Description
Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.
A Cross-Site Scripting (XSS) vulnerability has been identified in the Beego web framework for Go, prior to version 2.3.6. The issue arises in the RenderForm() function, which improperly escapes user-controlled data, allowing attackers to inject malicious JavaScript that executes in the context of the victim's browser. This could lead to session hijacking, credential theft, or account takeover. The vulnerability affects any application using the RenderForm() function with user-provided data, as the function generates complete form markup without adequate HTML escaping.
To address this vulnerability, update Beego to version 2.3.6 or later. If an immediate update is not possible, ensure that user-provided data is properly escaped before being inserted into HTML templates. This can be done by using Beego's template.HTMLEscapeString function on all dynamic values.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25 | [email protected] | Patch |
| https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| beego beego | < 2.3.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2025 | Initial Analysis | [email protected] |
| Mar 31, 2025 | New CVE Received | [email protected] |