Most recent entries from all

EUVD-2026-238025

fkie_cve-2025-46816

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.

GHSA-rwj2-w85g-5cmm — goshs route not protected, allows command execution

Affected: Go: github.com/patrickhener/goshs

### Summary

It seems that when running **goshs** without arguments it is possible for anyone to execute commands on the server. This was tested on version **1.0.4** of **goshs**. The command function was introduced in version **0.3.4**.

### Details

It seems that the function ```dispatchReadPump``` does not checks the option cli ```-c```, thus allowing anyone to execute arbitrary command through the use of websockets.

### PoC

Used **websocat** for the POC: ```bash echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t ```

### Impact

The vulnerability will only impacts goshs server on vulnerable versions.

openSUSE-SU-2025:15135-1 — govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media

govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media