The Go Fiber web framework versions before 2.52.12 and 3.1.0 contain a Cross-Site Scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. When a request includes an Accept header with 'text/html', and the handler uses the AutoFormat() feature, Fiber may emit raw HTML based on attacker-controlled input without proper sanitization. This occurs because AutoFormat() chooses the HTML branch based on the Accept header, which can be manipulated by an attacker to inject arbitrary HTML or JavaScript. The vulnerability is fixed in Fiber versions 2.52.12 and 3.1.0.

An attacker can remotely inject arbitrary HTML or JavaScript code into responses generated by the Fiber framework when the vulnerable AutoFormat() feature is used with attacker-controlled Accept headers. This can lead to Cross-Site Scripting attacks, potentially allowing theft of user credentials, session hijacking, or other malicious actions in the context of the victim's browser. The CVSS 4.0 score of 5.3 reflects a medium severity impact with network attack vector and no privileges required.

This vulnerability is fixed in Fiber versions 2.52.12 and 3.1.0. Users should upgrade to at least these versions to remediate the issue. Since no official remediation level or vendor advisory content is provided, patch status is inferred from the version information in the description. There are no indications that the vulnerability is mitigated by configuration or that no action is required. Therefore, upgrading the affected Fiber versions is the recommended mitigation.