Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/daytonaio/daytona

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
pkg.go.dev

Advisories 4

  • Daytona: Public sandbox previews remain accessible for up to one hour after being made private

    Affected: from 0.101.0, fixed in 0.184.0.

  • CVE-2026-54319Medium 4.2

    Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

    Affected: fixed in 0.186.0.

  • Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles

    Affected: fixed in 0.185.0.

  • CVE-2026-54324Medium 6.5

    Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

    Affected: fixed in 0.185.0.