Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hahwul/dalfox

4 known vulnerabilities (1 critical, 3 high), with the versions each affects and the releases that fix them.

Latest release
v1.2.1 (Aug 2, 2020): affected by 4 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
4 · 1 critical, 3 high
Releases
40 since v1.0.0 (May 3, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-45088
    Affects v1.0.0 to v3.2.5-0.20261012073331-e3573eb91ffd+incompatible (through the newest release)
  • CVE-2026-45087
    Affects v1.0.0 to v3.2.5-0.20261012073331-e3573eb91ffd+incompatible (through the newest release)
  • CVE-2026-45089
    Affects v1.0.0 to v3.2.5-0.20261012073331-e3573eb91ffd+incompatible (through the newest release)
  • CVE-2026-45090
    Affects v1.0.0 to v3.2.5-0.20261012073331-e3573eb91ffd+incompatible (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

    Affected: all versions.

    No fix released. The latest release, v1.2.1, is still affected.

  • CVE-2026-45087Critical 10.0

    Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

    Affected: all versions.

    No fix released. The latest release, v1.2.1, is still affected.

  • Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

    Affected: all versions.

    No fix released. The latest release, v1.2.1, is still affected.

  • Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

    Affected: all versions; through 1.2.2.

    No fix released. The latest release, v1.2.1, is still affected.