CRITICAL🇵🇱 Wersja polska

CVE-2025-30223

CVSS 9.3v3.1pub. 2025-03-31upd. 2025-08-01

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

🤖 AI Analysis
How it works

The RenderForm() function generates complete HTML form markup, however it does not apply proper escaping of user-supplied input data before placing it in HTML attributes. An attacker can supply crafted data containing malicious JavaScript code that will be embedded in the generated form without sanitization. Since RenderForm() is a high-level function, many developers assume it automatically escapes attributes — as most popular frameworks do — which makes the vulnerability likely to go unnoticed during code review.

Impact

An attacker can execute arbitrary JavaScript code in the victim's browser, which may lead to session hijacking, credential theft, or complete account takeover.

Mitigation & patch

Update Beego to version 2.3.6 or later, where the vulnerability has been fixed. The patch is available in the Beego project's GitHub repository (commit 939bb18c66406466715ddadd25dd9ffa6f169e25).

Who is affected

All applications using the Beego framework in versions before 2.3.6 that use the RenderForm() function with user-supplied data.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

  • Beego

    APP
    Beego
    < 2.3.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2022-31836CRITICAL9.8PL ✓same product

Path Traversal w Beego – funkcja leafInfo.match() umożliwia przejście katalogów

CVE-2022-31259CRITICAL9.8PL ✓same product

Beego: Pominięcie kontroli dostępu przez manipulację rozszerzeniem w route lookup

CVE-2021-30080CRITICAL9.8PL ✓same product

Beego: obejście kontroli dostępu w procesie wyszukiwania tras

CVE-2024-40464HIGH8.8same product

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function...

CVE-2024-40465HIGH8.8same product

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName ...