https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:13:39.064754+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-46816 CVE-2025-46816 — goshs route not protected, allows command execution 2026-10-07T16:13:39.080708+00:00

Affected: patrickhener goshs

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.