{"cve":"CVE-2025-55300","nvd":{"published":"2025-08-18T18:15:40.250","modified":"2026-06-17T09:41:36.737","status":"Deferred","description":"Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users. Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6},"cvss_v3":null,"cwes":["CWE-79"],"references":["https://github.com/komari-monitor/komari/commit/d31d12e59febce100ab0285b93338f09aa5d6cb1","https://github.com/komari-monitor/komari/security/advisories/GHSA-q355-h244-969h"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:06:45.861874017+00:00"},"epss":{"cve":"CVE-2025-55300","score":0.00553,"percentile":0.46181,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q355-h244-969h","url":"https://osv.dev/vulnerability/GHSA-q355-h244-969h","summary":"Komari vulnerable to Cross-site WebSocket Hijacking","modified":"2025-08-19T04:59:36.107083Z","packages":[{"ecosystem":"Go","name":"github.com/komari-monitor/komari","purl":"pkg:golang/github.com/komari-monitor/komari","ranges":["<0.0.0-20250809073044-53171affcaf0"],"fixed":["0.0.0-20250809073044-53171affcaf0"]}]},{"id":"GO-2025-3874","url":"https://osv.dev/vulnerability/GO-2025-3874","summary":"Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari","modified":"2026-03-03T04:56:48.901012Z","packages":[{"ecosystem":"Go","name":"github.com/komari-monitor/komari","purl":"pkg:golang/github.com/komari-monitor/komari","ranges":["<0.0.0-20250809073044-53171affcaf0"],"fixed":["0.0.0-20250809073044-53171affcaf0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}