CVE-2025-30223: Critical XSS in Beego RenderForm

CVE-2025-30223 is a critical (CVSS 9.3) cross-site scripting flaw in the Beego web framework for Go. The RenderForm() function does not escape user-controlled data. Versions before 2.3.6 are affected, and 2.3.6 fixes it. If your Go application builds forms with this helper from user supplied values, upgrade and rebuild.

What's affected

Beego versions up to 2.3.5 are affected, and 2.3.6 is the fixed version, according to the GitHub advisory for the Go package github.com/beego/beego.

Any application that calls RenderForm() with user provided data is affected. The advisory points out that many developers assume a function that generates a whole form also escapes attributes, as most frameworks do, so this may be present in code that looks safe.

The record does not flag the CVE as known exploited.

How to check if you're exposed

Look at your Go module files and your code.

1. Run go list -m all and look for github.com/beego/beego (or its v2 module path) and note the version. Anything below 2.3.6 is affected.
2. Search your code for RenderForm( and for form generation helpers in templates.
3. Trace what feeds the values, such as labels, display names and textarea content. If those come from users or from stored data that users can edit, you are exposed.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project's dependency list includes an affected component, and the Gold directory lets you look up the CVE and its related weaknesses.

What to do now

1. Upgrade Beego to 2.3.6 or later and rebuild and redeploy.
2. Search for every RenderForm() call and check whether the struct fields come from user input.
3. Where you can, escape or validate those values yourself and avoid putting untrusted text in labels and display names.
4. Add a Content Security Policy to limit script execution on pages that render forms.
5. Review stored data for unexpected markup in fields that feed these forms.

Why it matters

The record maps the flaw to CWE-79 (Cross-site Scripting). According to the advisory, the helper builds form markup by inserting values straight into HTML, without escaping the label, id, class, name or value, and it returns a type that tells the template engine the output is already safe. Attackers who control a value can break out of the attribute or inject a tag.

Script that runs in a victim's browser acts as that user. The advisory lists session hijacking, credential theft and account takeover as possible results. The high score reflects a changed scope in the vector, since the script runs in the context of the vulnerable site.

The deeper issue is the gap between what a helper seems to do and what it does. Convenience functions that return trusted markup need clear documentation and tests for escaping.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub security advisory
• Fix commit

Last reviewed: 19 October 2026.