CVE-2025-30223: Beego XSS Vulnerability in RenderForm Function
Summary
CVE-2025-30223: Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input. Affects github.com/beego/beego/v2 versions < 2.3.6. Fixed in 2.3.6. How to fix ↓
Also tracked for
The same CVE-2025-30223 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Beego is a popular open-source web framework for the Go programming language, designed to simplify the development of web applications. It provides a robust set of features, including MVC architecture, routing, and templating. However, a critical vulnerability has been identified in its RenderForm function, which improperly handles user input, leading to potential Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm function due to improper HTML escaping of user-controlled data. This flaw allows attackers to inject malicious JavaScript code that executes in victims' browsers, leading to severe consequences such as session hijacking, credential theft, and account takeover. The vulnerability arises from the renderFormField function in templatefunc.go, where user-provided values are directly inserted into HTML without escaping. This can result in attribute injection and content injection, making it particularly dangerous in applications that display user data.
How To Fix
Latest published version: v2.3.10 as of 23 Oct 2026
go get github.com/beego/beego/v2@v2.3.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.6
This is the first release that contains the fix.
go get github.com/beego/beego/v2@v2.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually escape user input before passing it to the RenderForm function. This can be done by using the template.HTMLEscapeString function on all user-provided values to prevent XSS attacks until the package is updated.
Conclusion
The identified XSS vulnerability in Beego's RenderForm function poses significant risks to applications using this framework. By updating to the patched version and implementing proper escaping of user input, developers can protect their applications from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/beego/beego/v2 →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include Cross-Site Scripting (XSS), session hijacking, credential theft, account takeover, and data exfiltration.
Yes, a patch is available in Beego version 2.3.6 and later. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, implement manual escaping of user input using template.HTMLEscapeString as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/beego/beego/v2.
