Skip to content
OpenAdvisories

Package · Go

github.com/xyproto/algernon

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • High 8.7
    CVE-2026-52792

    Algernon: Server-side script source disclosure on Windows via NTFS filename

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unaut…

    xyproto algernon github.com/xyproto/algernon Go
  • High 8.2
    CVE-2026-48126

    Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the config…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 4.3
    CVE-2026-46431

    Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not s…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 4.3
    CVE-2026-46430

    Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHost…

    xyproto algernon github.com/xyproto/algernon Go
  • High 7.5
    CVE-2026-45728

    Algernon: Single-file mode unconditionally enables debug mode

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whi…

    xyproto algernon github.com/xyproto/algernon Go
  • Critical 9.0
    CVE-2026-45721

    Algernon: handler.lua discovery walks parent directories above the server root

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 5.3
    GHSA-9v4j-7g44-qcqw

    Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

    ### Summary When auto-refresh is enabled, Algernon spins up an SSE handler that streams a `data:` line for every filesystem event under the watched directory. The handler performs **no authentication** of any kind — no shared token, no cookie check against th…

    github.com/xyproto/algernon Go
  • Medium 6.1
    CVE-2025-65754 Public exploit

    Algernon Cross-Site Scripting vulnerability

    Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

    github.com/xyproto/algernon Go
  • Medium 5.4
    CVE-2023-26131

    Algernon engine and themes vulnerable to Cross-site Scripting

    All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization…

    github.com/xyproto/algernon Go