CVE-2025-46816

Description

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.

Reserved 2025-04-30 | Published 2025-05-06 | Updated 2025-05-06 | Assigner GitHub_M

Problem types

CWE-284: Improper Access Control

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

>= 0.3.4, < 1.0.5
affected

References

github.com/.../goshs/security/advisories/GHSA-rwj2-w85g-5cmm

github.com/...ommit/160220974576afe5111485b8d12fd36058984cfa

cve.org (CVE-2025-46816)

nvd.nist.gov (CVE-2025-46816)

Download JSON