Skip to content
OpenAdvisories

Package · Go

github.com/tilt-dev/tilt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.3
    CVE-2026-55883

    Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

    Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader a…

    tilt-dev tilt github.com/tilt-dev/tilt Go
  • High 8.3
    CVE-2026-55882

    Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

    Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthe…

    tilt-dev tilt github.com/tilt-dev/tilt Go
  • Critical 9.2
    CVE-2026-55884

    Tilt: Missing authentication on the network-exposed Tilt HUD server

    Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an u…

    tilt-dev tilt github.com/tilt-dev/tilt Go