GoPackage

github.com/xyproto/algernon

8 known vulnerabilities (1 critical, 3 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release: v1.17.13 (Nov 5, 2026): no advisory affects it
Newest unaffected release: v1.17.13 (Nov 5, 2026), the latest release
Advisories: 8 · 1 critical, 3 high, 4 medium

Releases: 27 since v1.13.0 (May 9, 2022)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-52792
Affects v1.2.1-win8-64 to v1.17.8 (v1.17.9 is outside it)
CVE-2026-48126
Affects v1.2.1-win8-64 to v1.17.7 (v1.17.8 is outside it)
CVE-2026-46431
Affects v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it)
CVE-2026-46430
Affects v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it)
CVE-2026-45728
Affects v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it)
CVE-2026-45721
Affects v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it)
CVE-2025-65754
Affects v1.2.1-win8-64 to v1.17.4 (v1.17.5 is outside it)
CVE-2023-26131
Affects v1.2.1-win8-64 to v1.15.2 (v1.15.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-52792High 8.7
Algernon: Server-side script source disclosure on Windows via NTFS filename
Affected: fixed in 1.17.9.
Fixed in v1.17.9 (released May 29, 2026, 82 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2026-48126High 8.2
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Affected: fixed in 1.17.8.
Fixed in v1.17.8 (released May 24, 2026, 2 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2026-46431Medium 4.3
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
Affected: fixed in 1.17.7.
Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2026-46430Medium 4.3
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
Affected: fixed in 1.17.7.
Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2026-45728High 7.5
Algernon: Single-file mode unconditionally enables debug mode
Affected: fixed in 1.17.7.
Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2026-45721Critical 9.0
Algernon: handler.lua discovery walks parent directories above the server root
Affected: fixed in 1.17.7.
Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2025-65754Medium 6.1
Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a…
Affected: fixed in 1.17.5.
Fixed in v1.17.5 (released Nov 13, 2025, 27 days before disclosure).
The latest release, v1.17.13, is not affected.
CVE-2023-26131Medium 5.4
All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are…
Affected: through 1.15.2.
Fixed in v1.15.3 (released Aug 10, 2023, 71 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, v1.17.13, is not affected.