CVE-2026-43644 describes a reflected cross-site scripting vulnerability in the stefanprodan podinfo product, affecting versions through 6.11.2. The issue is in the /echo and /api/echo endpoints where the echoHandler returns the request body content directly in the response without explicitly setting Content-Type or X-Content-Type-Options headers. Due to Go's content type detection, the response is served as text/html, enabling execution of attacker-supplied script payloads in the context of the podinfo origin when users visit crafted cross-origin HTML pages with auto-submitting forms. This vulnerability allows attackers to execute scripts in the victim's browser under the podinfo origin, potentially leading to session hijacking or other script-based attacks.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of the podinfo origin by tricking victims into visiting malicious pages. This can lead to unauthorized actions performed on behalf of the victim, theft of sensitive information, or other script-based attacks. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the /echo and /api/echo endpoints to untrusted users or implement strict input validation and output encoding. Additionally, setting explicit Content-Type and X-Content-Type-Options headers in responses can help mitigate the risk of script execution.