{"action":"Upgrade github.com/lin-snow/ech0 to 1.4.8-0.20260503035519-fd320fe3e902 or later.","affected":[{"fixed":"1.4.8-0.20260503035519-fd320fe3e902","introduced":"0"}],"component":"github.com/lin-snow/ech0","cve_ids":["CVE-2026-79663"],"ecosystem":"Go","epss":0.00251,"exploited":false,"fixed_versions":["1.4.8-0.20260503035519-fd320fe3e902"],"ghsa_id":"GHSA-3v85-fqvh-7rxf","id":"tcs_01M5KGHWQ4M7KB8CQ2NZ70VC6Q","modified_at":"2026-08-27T04:10:39.381391554Z","published_at":"2026-06-25T18:26:48Z","references":["https://osv.dev/vulnerability/GO-2026-5100","https://github.com/lin-snow/Ech0/security/advisories/GHSA-3v85-fqvh-7rxf","https://github.com/lin-snow/Ech0/commit/fd320fe3e9021c8d8d284fb274775c018690520e"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5100","url":"https://osv.dev/vulnerability/GO-2026-5100"}],"summary":"Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0"}