The flaw arises from a flaw in the AutoFormat content‑negotiation logic of the Go Fiber framework. When AutoFormat is invoked, Fiber examines the Accept header of the incoming request. If the request contains Accept: text/html and the application has not explicitly opted into raw HTML emission, Fiber selects the HTML rendering branch. Because the framework does not escape or encode the data passed to AutoFormat, a remote attacker can supply user‑controlled input that is rendered unescaped in the response, enabling arbitrary HTML or JavaScript injection. This results in client‑side script execution in the victim's browser, with typical XSS consequences such as session hijacking, credential theft, or defacement.

Any application built with the Go Fiber web framework and using a version earlier than 2.52.12 or 3.1.0 is vulnerable. Fiber versions 2.x prior to 2.52.12 and 3.x prior to 3.1.0 contain the unprotected AutoFormat path. Any deployment that depends on these libraries and does not apply additional HTML escaping before invoking AutoFormat is at risk.

The CVSS base score of 5.3 represents moderate severity. No EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a crafted HTTP request that sets the Accept header to text/html, which is a remote, network‑based attack that does not require local privileges. If the application calls AutoFormat with data influenced by the attacker and has not opted into raw HTML rendering, the conditions for exploitation are satisfied. The weakness is categorized as CWE‑79, reflecting insufficient output encoding in a content‑negotiation context.