[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-GO-2026-4316":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":15,"downstream":16,"duplicates":19,"related":20,"reserved_at":9,"published_at":25,"modified_at":26,"state":9,"summary":27,"references_raw":29,"kevs":52,"epss":9,"epss_history":53,"metrics":54,"affected":61},"GO-2026-4316","chi has an open redirect vulnerability in the RedirectSlashes middleware\n\n### Summary\n\nThe `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.\n\n### Details\n\nThe `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).\n\nHowever, it does not trim backslashes (`\\`).\n\n```go\nFile: middleware/strip.go\n41: func RedirectSlashes(next http.Handler) http.Handler {\n...\n51: \t\t\t// Trim all leading and trailing slashes (e.g., \"//evil.com\", \"/some/path//\")\n52: \t\t\tpath = \"/\" + strings.Trim(path, \"/\")\n...\n62: }\n```\n\nAlso, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).\n\nThe above make it possible for a response in the following form:\n\n```\nHTTP/1.1 301 Moved Permanently\nLocation: /\\evil.com\n```\n\nThe `/\\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.\n\n### PoC\n\nA minimal working example can be seen below.\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\n\t\"github.com/go-chi/chi/v5\"\n\t\"github.com/go-chi/chi/v5/middleware\"\n)\n\n\n\nfunc main() {\n\tr := chi.NewRouter()\n\n\tr.Use(middleware.RedirectSlashes)\n\n\tr.Get(\"/*\", func(w http.ResponseWriter, r *http.Request) {\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\tfmt.Println(\"Server starting on port 8081...\")\n\tif err := http.ListenAndServe(\":8081\", r); err != nil {\n\t\tfmt.Printf(\"Error starting server: %v\\n\", err)\n\t}\n}\n\n```\n\nAnd when we request the path `/\\evil.com` (needs a second backslash or URL encoding in the terminal), the HTTP Redirect Location is just `/\\evil.com` without any domain/Host information.\n\n```bash\n$ curl -I  localhost:8081/\\\\evil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\n```bash\n$ curl -I  localhost:8081/%5Cevil.com/\nHTTP/1.1 301 Moved Permanently\nContent-Type: text/html; charset=utf-8\nLocation: /\\evil.com\n```\n\nThis opened in a browser (Chrome, Firefox) will result in a transformation to `//evil.com` which in turn will result in a redirect to `evil.com`.\n\u003Cimg width=\"200\" alt=\"image-20250829115619807\" src=\"https://github.com/user-attachments/assets/44aedad1-64b6-4660-8b26-fad9b4eca036\" />\n\n\n\u003Cimg width=\"200\" alt=\"image-20250829115632067\" src=\"https://github.com/user-attachments/assets/b976d47d-1975-469c-abd3-deb907a68db2\" />\n\n\n### Impact\n\nThis essentially consists of an open redirect vulnerability, provided that victim users use the most popular browsers (Chrome, Firefox, etc. It does not work in e.g. Safari).\n\nThe attacker can construct a malicious URL on a domain of a legitimate website and send it to the victim user. The victim users thinking that they will click on a legitimate website's URL, they will unknowingly be reidrected to an attacker controlled website.\n\nThis can lead to credential theft if the victim gets redirected to a phishing website, to malware that is hosted on the attacker controlled website etc. Also, it has a greate reputation / business impact for the affected legitimate website.\n\nIn order to exploit this vulnerability the attacker does not need to be authenticated or have ay other priviledge / knowledge regarding the affected application.\n\nCVSS Score: [4.7 (Medium)](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N)",null,[],[],[13,7,14],"GHSA-mqqf-5wvp-8fh8","GHSA-MQQF-5WVP-8FH8",[],[17],{"_key":18},"CVE-2025-69725",[],[21,23],{"_key":22},"CGA-W4P4-8MM4-CHRF",{"_key":24},"CGA-76M3-5FXV-Q2Q2","2026-01-14T21:18:06Z","2026-02-03T02:56:39.561588Z",{"cisa_kev":28,"cisa_ransomware":28,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[30,37,42,47],{"url":31,"sources":32,"tags":34},"https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8",[33],"osv_go",[35,36],"Advisory","WEB",{"url":38,"sources":39,"tags":40},"https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a",[33],[41,36],"FIX",{"url":43,"sources":44,"tags":45},"https://github.com/go-chi/chi/issues/1037",[33],[46,36],"REPORT",{"url":48,"sources":49,"tags":50},"https://github.com/go-chi/chi",[33],[51],"PACKAGE",[],[],[55],{"source":33,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":56,"cvss_v4_0":9},{"baseScore":57,"baseSeverity":9,"vectorString":58,"impactScore":59,"exploitabilityScore":60},4.7,"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",2.3,7.2,[62,79,84,89,94],{"ecosystem":63,"name":64,"vendor":65,"product":66,"cpe_part":9,"purl_type":67,"purl_namespace":65,"purl_name":66,"source":9,"versions":68},"Go","github.com/go-chi/chi","github.com/go-chi","chi","golang",[69,73],{"version":70,"is_range":71,"range_type":72,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"semver",{"version":74,"is_range":71,"range_type":72,"version_start":75,"version_start_type":76,"version_end":77,"version_end_type":78,"fixed_in":9},"gte5_2_2_lt5_2_4","5.2.2","including","5.2.4","excluding",{"ecosystem":63,"name":80,"vendor":64,"product":81,"cpe_part":9,"purl_type":67,"purl_namespace":64,"purl_name":81,"source":9,"versions":82},"github.com/go-chi/chi/v2","v2",[83],{"version":70,"is_range":71,"range_type":72,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":63,"name":85,"vendor":64,"product":86,"cpe_part":9,"purl_type":67,"purl_namespace":64,"purl_name":86,"source":9,"versions":87},"github.com/go-chi/chi/v3","v3",[88],{"version":70,"is_range":71,"range_type":72,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":63,"name":90,"vendor":64,"product":91,"cpe_part":9,"purl_type":67,"purl_namespace":64,"purl_name":91,"source":9,"versions":92},"github.com/go-chi/chi/v4","v4",[93],{"version":70,"is_range":71,"range_type":72,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":63,"name":95,"vendor":64,"product":96,"cpe_part":9,"purl_type":67,"purl_namespace":64,"purl_name":96,"source":9,"versions":97},"github.com/go-chi/chi/v5","v5",[98],{"version":74,"is_range":71,"range_type":72,"version_start":75,"version_start_type":76,"version_end":77,"version_end_type":78,"fixed_in":9}]