Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/ncw/rclone

2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Latest release
v1.48.0 (Jun 15, 2019): affected by 2 advisories
Newest unaffected release
v1.43.1 (Sep 7, 2018)
Advisories
2 · 2 critical
Releases
4 since v1.43.1 (Sep 7, 2018)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • CVE-2026-49980Critical 9.8

    Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

    Affected: from 1.46.0.

    No fix released. The latest release, v1.48.0, is still affected.

  • CVE-2026-41179Critical 9.2

    RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

    Affected: from 1.48.0.

    No fix released. The latest release, v1.48.0, is still affected.