The Go Fiber web framework contains a Cross-Site Scripting vulnerability (CWE-79) in its AutoFormat() feature. When a request includes an Accept: text/html header, and the handler passes attacker-influenced data to AutoFormat(), Fiber may emit raw HTML without proper neutralization. This occurs because Fiber chooses the HTML response branch based on the attacker-controlled Accept header, despite the developer not explicitly opting into raw HTML emission. This vulnerability affects Fiber versions before 2.52.12 and between 3.0.0-beta.2 and before 3.1.0. It allows remote attackers to inject arbitrary HTML or JavaScript, potentially leading to XSS attacks. The issue is resolved in versions 2.52.12 and 3.1.0.

Successful exploitation allows remote attackers to inject arbitrary HTML or JavaScript code into responses generated by the Fiber framework when using the AutoFormat() feature with attacker-controlled Accept headers. This can lead to Cross-Site Scripting attacks, potentially impacting users by executing malicious scripts in their browsers. The CVSS score of 5.3 reflects a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed.

A fix for this vulnerability is available in Fiber versions 2.52.12 and 3.1.0. Users should upgrade to at least these versions to remediate the issue. Since no official vendor advisory content is provided, patch status is inferred from the description stating the vulnerability is fixed in these versions. No additional mitigation steps are indicated.