Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/google/cel-go

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3GoAmendedPublished

    cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

    GHSA-gcjh-h69q-9w9g

    Affected
    • Go github.com/google/cel-go >= 0.22.0, <= 0.28.1
    Fixed in
    0.29.0· Vendor fix available
    Issue
    The function ext.NativeTypes(ParseStructTag("json")) does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dyn(obj)["-"]. Additionally, newNativeTypes silently registers every nested struct reachable from the type passed to NativeTypes, including types from third-party dependencies the developer never examined. Root cause In fieldNameByTag, the helper used by ParseStructTag("json") to translate Go struct tags into CEL field names. See at ext/native.go:146: For a field tagged json:"-", this code splits the tag into []string{"-"} and returns "-" as the CEL field name. It never checks whether "-" is the JSON skip sentinel. This contradicts the encoding/json rule that the source comment explicitly points readers to: The public option also documents JSON-style parsing as the intended behavior. See at ext/native.go:190: A developer using…

    Recommended action: Upgrade to 0.29.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →