CVE-2025-30223 - CVE House
Back to Database
Status published Critical CVE-2025-30223

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

Vulnerability Description

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30223

Credits & Attribution

No credits recorded in the NVD database.

References

More from beego

View All →
CVE-2024-55885
Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames
Medium 6.9
CVE-2022-31836
The leafInfo.match() function in Beego v2.0.3 and below uses path.join()...
Critical 9.8
CVE-2022-31259
The route lookup process in beego before 1.12.9 and 2.x...
Critical 9.8
CVE-2021-39391
Cross Site Scripting (XSS) vulnerability exists in the admin panel...
Medium 6.1
CVE-2021-30080
An issue was discovered in the route lookup process in...
Critical 9.8

Affected Vendor

Affected Software

beego
Vulnerable Versions:
< 2.3.6

Timeline

Official Publish: March 31st, 2025
Last Modified: March 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact