Skip to content
OpenAdvisories

Package · Go

github.com/dagu-org/dagu

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-31886

    Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution

    Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation…

    dagu-org dagu github.com/dagu-org/dagu Go
  • Critical 9.8
    GHSA-6qr9-g2xw-cw92

    Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

    ### Summary Dagu's default configuration ships with authentication disabled. The `POST /api/v2/dag-runs` endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the netwo…

    github.com/dagu-org/dagu Go