Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M

CVE-2025-30223Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

Critical 9.3

In plain English

A critical-severity cross-site scripting in beego from beego. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/beego/beego	no fix listed	GHSA-2j42-h78h-q4fg
Go	github.com/beego/beego	no fix listed	GO-2025-3585
Go	github.com/beego/beego/v2	2.3.6	GHSA-2j42-h78h-q4fg
Go	github.com/beego/beego/v2	2.3.6	GO-2025-3585

Affected products (as reported)

Vendor	Product	Versions
beego	beego	< 2.3.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg x_refsource_CONFIRM
https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25 x_refsource_MISC