Security vulnerabilities and automated fixes for go issues
12 posts found
A high-severity JavaScript injection vulnerability in `internal/clusterconfigs/input.go` allowed arbitrary code execution through malicious kubeconfig filenames. The `saveClusterConfigFile` function at line 20 constructed JavaScript code by directly interpolating unsanitized filenames into `window.ExecJS()` calls, enabling attackers to break out of string literals and execute arbitrary JavaScript in the Webview context.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in `internal/web/controller/server.go` where the `applySubTemplate` endpoint accepted arbitrary URLs from user input and passed them directly to `serverService.ApplySubTemplateFromGithub()` without any host validation. An attacker could exploit this to make the server issue HTTP requests to internal network resources, cloud metadata endpoints, or redirect-controlled destinations. The fix introduces a strict allowlist that restrict
A high-severity denial-of-service flaw (CVE-2026-56852) in golang.org/x/text's Unicode normalization iterator (`norm.Iter`) could cause an infinite loop when processing specially crafted input. The `mcp` module's `go.mod`/`go.sum` pinned a vulnerable v0.14.0 release; upgrading to v0.39.0 closes the hole.
A critical vulnerability in containerd v1.7.32 allowed attackers to execute arbitrary commands as root on the host by manipulating image configuration labels processed by the CRI plugin. Upgrading to containerd v1.7.33 eliminates this attack vector through improved input validation.
CVE-2026-42151 is a high-severity information disclosure vulnerability in the Prometheus monitoring library (github.com/prometheus/prometheus) that exposed Azure OAuth client secrets through the Prometheus configuration API endpoint. Applications depending on versions prior to v0.311.3 were at risk of leaking sensitive Azure credentials to anyone with access to the config API. The fix involves upgrading the dependency in go.mod from v0.310.0 to v0.311.3.
A high-severity privilege escalation vulnerability (CVE-2026-46680) was discovered in containerd v1.7.31, where incorrect user ID handling could allow an attacker to escalate privileges within container environments. The fix upgrades the `github.com/containerd/containerd` dependency from v1.7.31 to v1.7.32, which corrects the UID handling logic and introduces additional transitive dependencies for secure path resolution.
A high-severity denial of service vulnerability (CVE-2026-32287) was discovered in the `github.com/antchfx/xpath` Go library, where crafted boolean XPath expressions could trigger an infinite loop, consuming CPU resources indefinitely. The fix upgrades the dependency from v1.3.3 to v1.3.6 in the `go.mod` file of the affected project. This vulnerability is particularly dangerous for any Go application that parses or evaluates XPath expressions from untrusted input.
A critical vulnerability in the file upload handler allowed attackers to inject CRLF sequences into HTTP response headers through crafted filenames. The fix sanitizes user-supplied filenames before using them in Content-Disposition headers, preventing header injection attacks that could lead to cache poisoning, session fixation, or XSS.
CVE-2026-56852 is a high-severity vulnerability in golang.org/x/text that allows the Unicode normalization iterator to enter an infinite loop when processing specially crafted input. This fix upgrades the dependency from v0.37.0 to v0.39.0, tightening input validation and preventing denial-of-service attacks in applications that process untrusted Unicode text.
A high-severity vulnerability (CVE-2026-27896) in the Model Context Protocol Go SDK v1.3.0 allowed attackers to bypass security controls through improper handling of case sensitivity. The fix upgrades the dependency from v1.3.0 to v1.3.1, which correctly normalizes case comparisons. This vulnerability was particularly concerning for CLI tools where attackers could manipulate input to evade validation logic.
A high-severity denial of service vulnerability (CVE-2025-22869) was discovered in the SSH key exchange implementation of Go's `golang.org/x/crypto` library. The `cpdaemon` service depended on the vulnerable version v0.32.0, which could allow an attacker to exhaust server resources during the SSH handshake phase. The fix upgrades the dependency to v0.35.0, which includes the upstream patch for this vulnerability.
A critical command injection vulnerability was discovered in `drivers/local/util.go` where user-influenced file paths were passed directly to `ffmpeg.Input()` without any sanitization. Because many ffmpeg wrapper libraries construct shell command strings under the hood, an attacker could embed shell metacharacters in a file path to execute arbitrary OS commands with server-level privileges. The fix introduces a `sanitizeFilePath()` function that validates paths are absolute, clean, and point to