Insufficient content type validation of proxied resources in go-camo prior to 2.1.1 allows a remote malicious user to serve arbitrary content from go-camo's origin.
go-camo project go-camo