- Latest release
- v2.13.0 (May 7, 2026): no advisory affects it
- Newest unaffected release
- v2.13.0 (May 7, 2026), the latest release
- Advisories
- 4 · 1 critical, 3 high
- Releases
- 46 since v2.3.0 (Feb 15, 2021)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-45088Affects v2.3.0-pre.1 to v2.12.0 (v2.13.0 is outside it)
- CVE-2026-45087Affects v2.3.0-pre.1 to v2.12.0 (v2.13.0 is outside it)
- CVE-2026-45089Affects v2.3.0-pre.1 to v2.12.0 (v2.13.0 is outside it)
- CVE-2026-45090Affects v2.3.0-pre.1 to v2.12.0 (v2.13.0 is outside it)
Advisories 4
- CVE-2026-45088High 7.5
Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode
Affected: fixed in 2.13.0.
Fixed in v2.13.0 (released May 7, 2026, 20 days before disclosure).
The latest release, v2.13.0, is not affected.
- CVE-2026-45087Critical 10.0
Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
Affected: fixed in 2.13.0.
Fixed in v2.13.0 (released May 7, 2026, 20 days before disclosure).
The latest release, v2.13.0, is not affected.
- CVE-2026-45089High 8.2
Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode
Affected: fixed in 2.13.0.
Fixed in v2.13.0 (released May 7, 2026, 20 days before disclosure).
The latest release, v2.13.0, is not affected.
- CVE-2026-45090High 7.5
Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Affected: fixed in 2.13.0.
Fixed in v2.13.0 (released May 7, 2026, 20 days before disclosure).
The latest release, v2.13.0, is not affected.