Skip to content
OpenAdvisories

Package · Go

github.com/tilt-dev/tilt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.3
    CVE-2026-55883

    Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

    Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websocket_token endpoint and the upgrader a…

    tilt-dev tilt github.com/tilt-dev/tilt Go
  • High 8.3
    CVE-2026-55882

    Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

    Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthe…

    tilt-dev tilt github.com/tilt-dev/tilt Go