The vulnerability is a reflected cross‑site scripting flaw in podinfo version 6.11.2’s /echo and /api/echo endpoints. The echo handler returns the request body directly to the browser without setting a Content‑Type or X‑Content‑Type‑Options header, causing Go to infer the payload as text/html. Attackers can embed malicious script in a cross‑origin form that auto‑submits to the podinfo endpoints, which then reflects the script in the response served as HTML. The reflected script executes in the podinfo origin context when a victim visits the attacker’s page. Inferred, this could allow an attacker to hijack sessions, steal credentials, or modify client‑side data within the podinfo origin.

Podinfo, a lightweight demo application maintained by stefanprodan on GitHub, is affected by this flaw in version 6.11.2 and earlier releases. The CVE specifically references the 6.11.2 release, so any deployment of that version is vulnerable unless patched or upgraded.

The CVSS score of 5.1 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote, web‑based attack in which a victim visits an attacker‑controlled HTML page that auto‑submits a crafted form to podinfo. Privilege escalation is not required; the attack relies solely on the execution of client‑side code in the podinfo origin context. The risk is moderate, and the vulnerability can be mitigated by patching or applying the recommended controls.