Executive brief
Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
Affected products
- Go github.com/xyproto/algernon
Junglewise Threat Intelligence
CVE-2025-65754: GO-2025-4228 - Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
CVE-2025-65754 · Severity: medium · CVSS 4 · Published 2025-12-15
Technologies: github.com/xyproto/algernon (Go). Vendors: Go.
Related threats
- xyproto Algernon source disclosure via NTFS filename manipulation
- GO-2026-5300 - Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xypr
- xyproto Algernon path traversal and RCE via Host header
- xyproto Algernon permissive CORS policy in SSE event server
- xyproto Algernon information disclosure in single-file mode