GoPackage

github.com/lin-snow/ech0

17 known vulnerabilities (1 critical, 8 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release: v1.4.7 (May 31, 2025): affected by 17 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 17 · 1 critical, 8 high, 8 medium

Releases: 34 since v1.0.0 (May 17, 2025)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-79673
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79672
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79671
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79670
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79669
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79668
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-79667
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79666
Affects v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release)
CVE-2026-79664
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-79663
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-79662
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-79661
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)

Show all 17 advisoriesShow fewer advisories

CVE-2026-79660
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-79659
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-35037
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-35036
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)
CVE-2026-33638
Affects v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

CVE-2026-79673High 8.5
Ech0 before 4.4.3 Scope Bypass via profile:read Token
Affected: all versions; fixed in 4.4.3.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79672High 7.0
Ech0 before 4.4.3 Authentication Bypass via Comment Panel
Affected: all versions; fixed in 4.4.3.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79671Medium 5.1
Ech0 before 4.4.3 SSRF via DNS Resolution Bypass
Affected: fixed in 4.4.3; all versions.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79670Medium 4.8
Ech0 before 4.4.3 Stored XSS via SVG Upload
Affected: all versions; fixed in 4.4.3.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79669Medium 5.3
Ech0 before 4.4.3 Missing Authorization on System Logs
Affected: fixed in 4.4.3; all versions.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79668Medium 6.9
Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation
Affected: fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1.
No fix released. The advisory names 1.4.8-0.20260503040728-a7e8b8e84bd1 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79667High 7.2
Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
Affected: all versions; fixed in 4.3.5.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79666High 7.1
Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
Affected: all versions; fixed in 4.3.5.
No fix released. The latest release, v1.4.7, is still affected.
CVE-2026-79664Critical 9.1
Ech0 before 4.7.3 Access Token Revocation Bypass
Affected: fixed in 1.4.8-0.20260503041146-eab62379c795.
No fix released. The advisory names 1.4.8-0.20260503041146-eab62379c795 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79663Medium 4.8
Ech0 before 4.7.3 Stored XSS via RSS feed tag names
Affected: fixed in 1.4.8-0.20260503035519-fd320fe3e902; fixed in 1.4.8-0.20260503035519-fd320fe3e902.
No fix released. The advisory names 1.4.8-0.20260503035519-fd320fe3e902 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79662High 8.8
Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass
Affected: fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1; fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1.
No fix released. The advisory names 1.4.8-0.20260503040728-a7e8b8e84bd1 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79661Medium 6.9
Ech0 before 4.7.3 Unauthenticated fav_count Modification
Affected: fixed in 1.4.8-0.20260503035905-cecc2c19b590; fixed in 1.4.8-0.20260503035905-cecc2c19b590.
No fix released. The advisory names 1.4.8-0.20260503035905-cecc2c19b590 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79660Medium 6.9
Ech0 before 4.7.3 Email Disclosure via Public API
Affected: fixed in 1.4.8-0.20260503034700-cb8d7a997dd8; fixed in 1.4.8-0.20260503034700-cb8d7a997dd8.
No fix released. The advisory names 1.4.8-0.20260503034700-cb8d7a997dd8 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-79659High 8.3
Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo
Affected: fixed in 1.4.8-0.20260503040602-091d26d2d942.
No fix released. The advisory names 1.4.8-0.20260503040602-091d26d2d942 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-35037High 7.2
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
Affected: fixed in 1.4.8-0.20260401031029-4ca56fea5ba4.
No fix released. The advisory names 1.4.8-0.20260401031029-4ca56fea5ba4 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.

Show all 17 advisoriesShow fewer advisories

CVE-2026-35036High 7.5
Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature
Affected: fixed in 1.4.8-0.20260401031029-4ca56fea5ba4.
No fix released. The advisory names 1.4.8-0.20260401031029-4ca56fea5ba4 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.
CVE-2026-33638Medium 5.3
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Affected: fixed in 1.4.8-0.20260322121226-acbf1fd71011.
No fix released. The advisory names 1.4.8-0.20260322121226-acbf1fd71011 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected.