# github.com/xyproto/algernon (Go) vulnerabilities 8 known vulnerabilities (1 critical, 3 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.17.13 (Nov 5, 2026): no advisory affects it - Newest unaffected release: v1.17.13 (Nov 5, 2026), the latest release - Releases: 27 since v1.13.0 (May 9, 2022) - Registry: https://pkg.go.dev/github.com/xyproto/algernon - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-52792: v1.2.1-win8-64 to v1.17.8 (v1.17.9 is outside it) - CVE-2026-48126: v1.2.1-win8-64 to v1.17.7 (v1.17.8 is outside it) - CVE-2026-46431: v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it) - CVE-2026-46430: v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it) - CVE-2026-45728: v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it) - CVE-2026-45721: v1.2.1-win8-64 to v1.17.6 (v1.17.7 is outside it) - CVE-2025-65754: v1.2.1-win8-64 to v1.17.4 (v1.17.5 is outside it) - CVE-2023-26131: v1.2.1-win8-64 to v1.15.2 (v1.15.3 is outside it) ## Advisories (8) ### [CVE-2026-52792](https://cve.now/CVE-2026-52792): Algernon: Server-side script source disclosure on Windows via NTFS filename - Severity: High 8.7 - Published: Aug 19, 2026 - Affected: fixed in 1.17.9. - Fixed in v1.17.9 (released May 29, 2026, 82 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2026-48126](https://cve.now/CVE-2026-48126): Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir - Severity: High 8.2 - Published: May 26, 2026 - Affected: fixed in 1.17.8. - Fixed in v1.17.8 (released May 24, 2026, 2 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2026-46431](https://cve.now/CVE-2026-46431): Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: \* - Severity: Medium 4.3 - Published: May 26, 2026 - Affected: fixed in 1.17.7. - Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2026-46430](https://cve.now/CVE-2026-46430): Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS - Severity: Medium 4.3 - Published: May 26, 2026 - Affected: fixed in 1.17.7. - Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2026-45728](https://cve.now/CVE-2026-45728): Algernon: Single-file mode unconditionally enables debug mode - Severity: High 7.5 - Published: May 26, 2026 - Affected: fixed in 1.17.7. - Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2026-45721](https://cve.now/CVE-2026-45721): Algernon: handler.lua discovery walks parent directories above the server root - Severity: Critical 9.0 - Published: May 26, 2026 - Affected: fixed in 1.17.7. - Fixed in v1.17.7 (released May 12, 2026, 14 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2025-65754](https://cve.now/CVE-2025-65754): Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a… - Severity: Medium 6.1 - Published: Dec 10, 2025 - Affected: fixed in 1.17.5. - Fixed in v1.17.5 (released Nov 13, 2025, 27 days before disclosure). - The latest release, v1.17.13, is not affected. ### [CVE-2023-26131](https://cve.now/CVE-2023-26131): All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are… - Severity: Medium 5.4 - Published: May 31, 2023 - Affected: through 1.15.2. - Fixed in v1.15.3 (released Aug 10, 2023, 71 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, v1.17.13, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/xyproto/algernon Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.