https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:45:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-321461 EUVD-2026-321461 https://cve.radiocsirt.org/vuln/euvd-2026-321461 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45728 <p>Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.</p> <p>Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45728 https://cve.radiocsirt.org/vuln/ghsa-fwqx-8365-9983 <p><strong>Affected:</strong> Go: github.com/xyproto/algernon</p> <p>### Summary</p> <p>When Algernon is invoked with a single file path instead of a directory — the documented &#34;quick demo&#34; workflow (`algernon foo.lua`, `algernon page.po2`, `algernon index.html`, `algernon mywebsite.alg`) — `singleFileMode` is set to true and **`debugMode` is forcibly enabled** with no opt-out:</p> <p>```go // engine/config.go:498-502 // Make a few changes to the defaults if we are serving a single file if ac.singleFileMode { ac.debugMode = true ac.serveJustHTTP = true } ```</p> <p>`debugMode` activates the `PrettyError` renderer, which on any Lua or template error response dumps:</p> <p>1. The **absolute path** of the file that errored (`Filename` field of the error template). 2. The **complete byte contents** of that file, HTML-escaped, with the offending line wrapped in `&lt;font style=&#39;color: red !important&#39;&gt;…&lt;/font&gt;`. 3. The exception or parser error text — which in turn often quotes additional file content (Pongo2 errors include surrounding template lines; Lua tracebacks include argument values).</p> <p>This response is served with `HTTP 200 OK` to whoever sent the request that triggered the error. There is no authentication, no rate limit specific to errors, no redaction, and no opt-out short of avoiding single-file invocations entirely. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request.</p> <p>This combines particularly badly wi…</p> <p><strong>Affected:</strong> Go: github.com/xyproto/algernon</p> <p>### Summary</p> <p>When Algernon is invoked with a single file path instead of a directory — the documented &#34;quick demo&#34; workflow (`algernon foo.lua`, `algernon page.po2`, `algernon index.html`, `algernon mywebsite.alg`) — `singleFileMode` is set to true and **`debugMode` is forcibly enabled** with no opt-out:</p> <p>```go // engine/config.go:498-502 // Make a few changes to the defaults if we are serving a single file if ac.singleFileMode { ac.debugMode = true ac.serveJustHTTP = true } ```</p> <p>`debugMode` activates the `PrettyError` renderer, which on any Lua or template error response dumps:</p> <p>1. The **absolute path** of the file that errored (`Filename` field of the error template). 2. The **complete byte contents** of that file, HTML-escaped, with the offending line wrapped in `&lt;font style=&#39;color: red !important&#39;&gt;…&lt;/font&gt;`. 3. The exception or parser error text — which in turn often quotes additional file content (Pongo2 errors include surrounding template lines; Lua tracebacks include argument values).</p> <p>This response is served with `HTTP 200 OK` to whoever sent the request that triggered the error. There is no authentication, no rate limit specific to errors, no redaction, and no opt-out short of avoiding single-file invocations entirely. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request.</p> <p>This combines particularly badly wi…</p> https://cve.radiocsirt.org/vuln/ghsa-fwqx-8365-9983