Executive brief
Algernon engine and themes vulnerable to Cross-site Scripting
Affected products
- Go github.com/xyproto/algernon
Junglewise Threat Intelligence
CVE-2023-26131: Algernon engine and themes vulnerable to Cross-site Scripting
CVE-2023-26131 · Severity: low · CVSS 3.1 · Published 2023-05-31
Technologies: github.com/xyproto/algernon (Go). Vendors: Go.
Related threats
- xyproto Algernon source disclosure via NTFS filename manipulation
- GO-2026-5300 - Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xypr
- xyproto Algernon path traversal and RCE via Host header
- xyproto Algernon permissive CORS policy in SSE event server
- xyproto Algernon information disclosure in single-file mode