Skip to content
OpenAdvisories

Package · Go

github.com/xyproto/algernon

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-46431

    Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not s…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 4.3
    CVE-2026-46430

    Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHost…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 5.3
    GHSA-9v4j-7g44-qcqw

    Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

    ### Summary When auto-refresh is enabled, Algernon spins up an SSE handler that streams a `data:` line for every filesystem event under the watched directory. The handler performs **no authentication** of any kind — no shared token, no cookie check against th…

    github.com/xyproto/algernon Go
  • Medium 6.1
    CVE-2025-65754 Public exploit

    Algernon Cross-Site Scripting vulnerability

    Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

    github.com/xyproto/algernon Go
  • Medium 5.4
    CVE-2023-26131

    Algernon engine and themes vulnerable to Cross-site Scripting

    All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization…

    github.com/xyproto/algernon Go