CVE-2026-43644 Details

A reflected cross-site scripting vulnerability has been identified in podinfo versions through 6.11.2. The issue resides in the '/echo' and '/api/echo' endpoints, where the 'echoHandler' function writes the request body content directly to the response without including explicit 'Content-Type' or 'X-Content-Type-Options' headers. This oversight allows attackers to create cross-origin HTML pages with auto-submitting forms that contain script payloads in the request body. When these payloads are reflected back as 'text/html' due to Go's content type detection, the scripts execute in the context of the podinfo origin when victims visit the attacker's page.

To address this vulnerability, set an explicit non-HTML 'Content-Type' header, add 'X-Content-Type-Options: nosniff', and implement a restrictive 'Content-Security-Policy' before writing the echoed body. After applying this patch, the '/echo' and '/api/echo' endpoints will no longer render responses as HTML, effectively mitigating the cross-site scripting risk.