CVE-2020-24553: Cross-site scripting in net/http/cgi and net/http/fcgi
Summary
CVE-2020-24553: Cross-site scripting in net/http/cgi and net/http/fcgi. Affects stdlib across 2 version ranges.
< 1.14.8
>= 1.15.0-0, < 1.15.1
Fixed in 1.14.8 or 1.15.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2020-24553 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. The net/http/cgi and net/http/fcgi packages within the stdlib package are used for handling Common Gateway Interface (CGI) and FastCGI requests in Go web applications. These packages allow Go programs to interact with web servers and process HTTP requests. However, a vulnerability exists in these packages that could lead to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises when a Handler does not explicitly set the Content-Type header in the HTTP response. In such cases, the package defaults to 'text/html' as the Content-Type, which can be exploited by an attacker to perform a cross-site scripting attack. If an attacker can control any part of the response content, they can inject malicious scripts that will be executed by the victim's browser. This can lead to various consequences, including the theft of sensitive information, session hijacking, or the spread of malware. The Content-Type header is now set based on the contents of the first Write using http.DetectContentType, aligning with the behavior of the net/http package. However, it is important to note that not setting the Content-Type header explicitly on any attacker-controlled file is still unsafe and should be avoided.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.14.81.14.8go get stdlib@v1.14.8 -
>= 1.15.0-0, < 1.15.11.15.1go get stdlib@v1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can manually set the Content-Type header to an appropriate value for the response. For example, if the response contains HTML content, the Content-Type header can be set to 'text/html'. This can be achieved using the response.Header().Set() method in the Go code. By explicitly setting the Content-Type header, developers can ensure that the correct content type is conveyed to the client, reducing the risk of XSS vulnerabilities.
Conclusion
The cross-site scripting vulnerability in the net/http/cgi and net/http/fcgi packages of the stdlib package in Go can have severe consequences if exploited. It is crucial to update to the fixed Go versions (1.14.8 or 1.15.1) and explicitly set the Content-Type header for any attacker-controlled file to mitigate the risk of XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows an attacker to inject malicious scripts into the response of a Go web application, leading to potential cross-site scripting attacks. The consequences of successful exploitation can range from the theft of sensitive information to the spread of malware.
Versions 0, 1.15.0-0, and earlier are affected. The vulnerability has been fixed in versions 1.14.8 and 1.15.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been patched in Go versions 1.14.8 and 1.15.1. It is recommended to update to these fixed versions to mitigate the risk of cross-site scripting attacks.
If updating to the fixed Go versions is not immediately possible, you can apply the workaround mentioned in the 'workaround' section of this report. By manually setting the Content-Type header in the response, you can reduce the risk of cross-site scripting vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
