GoPackage

github.com/getarcaneapp/arcane/backend

10 known vulnerabilities (2 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v1.20.0 (Jun 4, 2026): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 10 · 2 critical, 6 high, 2 medium

Releases: 20 since v1.15.3 (Feb 20, 2026)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-96627
Affects v1.15.3 to v1.20.0 (through the newest release)
CVE-2026-96628
Affects v1.15.3 to v1.20.0 (through the newest release)
CVE-2026-45625
Affects v1.15.3 to v1.18.1 (v1.19.0 is outside it)
CVE-2026-45626
Affects v1.15.3 to v1.20.0 (through the newest release)
CVE-2026-45627
Affects v1.15.3 to v1.18.1 (v1.19.0 is outside it)
CVE-2026-47125
Affects v1.15.3 to v1.19.1 (v1.19.2 is outside it)
CVE-2026-47179
Affects v1.15.3 to v1.19.3 (v1.19.4 is outside it)
CVE-2026-42461
Affects v1.15.3 to v1.17.4 (v1.18.0 is outside it)
CVE-2026-40242
Affects v1.15.3 to v1.17.2 (v1.17.3 is outside it)
CVE-2026-23520
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-96627High 8.8
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Affected: all versions.
No fix released. The latest release, v1.20.0, is still affected.
CVE-2026-96628Medium 4.3
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
Affected: all versions.
No fix released. The latest release, v1.20.0, is still affected.
CVE-2026-45625Critical 9.9
Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper…
Affected: fixed in 1.19.0.
Fixed in v1.19.0 (released May 11, 2026, 18 days before disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-45626Medium 6.3
Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter
Affected: all versions; through 1.18.1.
No fix released. The latest release, v1.20.0, is still affected.
CVE-2026-45627High 8.2
Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover
Affected: fixed in 1.19.0.
Fixed in v1.19.0 (released May 11, 2026, 18 days before disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-47125High 8.8
Arcane: Missing admin authorization on global variables endpoint
Affected: fixed in 1.19.2.
Fixed in v1.19.2 (released May 17, 2026, 12 days before disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-47179High 7.7
Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane
Affected: fixed in 1.19.4.
Fixed in v1.19.4 (released May 18, 2026, 11 days before disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-42461High 8.7
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
Affected: fixed in 1.18.0.
Fixed in v1.18.0 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-40242High 7.2
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Affected: fixed in 1.17.3.
Fixed in v1.17.3 (released Apr 10, 2026, the day of disclosure).
The latest release, v1.20.0, is not affected.
CVE-2026-23520Critical 9.1
Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE
Affected: fixed in 0.0.0-20260114065515-5a9c2f92e11f.
Fixed in v1.15.3 (released Feb 20, 2026, 36 days after disclosure, the advisory names 0.0.0-20260114065515-5a9c2f92e11f, which was never published).
The latest release, v1.20.0, is not affected.