CVE-2020-36567: Arbitrary log line injection in github.com/gin-gonic/gin
Summary
CVE-2020-36567: Arbitrary log line injection in github.com/gin-gonic/gin. Affects github.com/gin-gonic/gin versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- golang-github-gin-gonic-gin · Debian:11
The same CVE-2020-36567 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/gin-gonic/gin is a Go web framework that provides a set of features for building web applications. It includes a Logger middleware that logs HTTP requests and responses. The default Formatter for the Logger middleware allows attackers to inject arbitrary log entries by manipulating the request path.
Vulnerability Detail
The vulnerability (CVE-2020-36567) in github.com/gin-gonic/gin allows attackers to inject arbitrary log entries by manipulating the request path. This can lead to the execution of malicious code or the exposure of sensitive information. The default Formatter for the Logger middleware is affected, making it possible for attackers to exploit this vulnerability.
How To Fix
Latest published version: v1.12.0 as of 22 Oct 2026
go get github.com/gin-gonic/gin@v1.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
go get github.com/gin-gonic/gin@v1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in github.com/gin-gonic/gin allows attackers to inject arbitrary log entries, posing a risk of executing malicious code or exposing sensitive information. It is crucial to upgrade to version 1.6.0 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/gin-gonic/gin →
FAQ
This vulnerability allows attackers to inject arbitrary log entries, which can lead to the execution of malicious code or the exposure of sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the moment. However, it is important to patch your application to prevent any potential attacks.
Yes, a fix is available in version 1.6.0 of github.com/gin-gonic/gin. It is recommended to upgrade to this version or later to mitigate the vulnerability.
You can find more information about this vulnerability in the Open Source Vulnerability database (https://pkg.go.dev/vuln/GO-2020-0001).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gin-gonic/gin.
