cve.nowby Sazabi

GoPackage

github.com/yokecd/yoke

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: v0.22.4 (Oct 26, 2026): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 high

Releases: 144 since v0.1.2 (Oct 24, 2024)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-26056
Affects v0.1.2 to v0.22.4 (through the newest release)
CVE-2026-26055
Affects v0.1.2 to v0.22.4 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-26056High 8.8
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
Affected: through 0.19.0; all versions.
No fix released. The latest release, v0.22.4, is still affected.
CVE-2026-26055High 7.5
Unauthenticated Admission Webhook Endpoints in Yoke ATC
Affected: all versions; through 0.19.0.
No fix released. The latest release, v0.22.4, is still affected.