—
GO-2026-5100
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0
Details
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/lin-snow/ech0
Introduced in:
0 Fixed in: 1.4.8-0.20260503035519-fd320fe3e902 Fix
go get github.com/lin-snow/ech0@v1.4.8-0.20260503035519-fd320fe3e902