CVSS 3.0
9.4 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LCVE-2025-46816
Critical (9.4). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/patrickhener/goshs 1.0.5.
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-77, CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rwj2-w85g-5cmm | Go | github.com/patrickhener/goshs | >=0.3.4 <1.0.5 | 1.0.5 |
| GO-2025-3672 | Go | github.com/patrickhener/goshs | >=0.3.4 <1.0.5 | 1.0.5 |