Skip to content
OpenAdvisories

Package · Go

github.com/umputun/remark42

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-77463

    Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

    Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trust…

    umputun remark42 github.com/umputun/remark42 github.com/umputun/remark42/backend Go
  • High 8.2
    CVE-2026-48788

    Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

    Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image pro…

    umputun remark42 github.com/umputun/remark42 Go