Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/komari-monitor/komari < 0.0.0-20260609084633-98122fa4d110
Fixed in
0.0.0-20260609084633-98122fa4d110· Vendor fix available
Issue
Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes (login.go:68). All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default SameSite=Lax behavior. Root Cause Gin's ShouldBindJSON does not strictly validate the Content-Type header, allowing text/plain requests to bypass CORS preflight. Browser Limitations - Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to SameSite=Lax. - Cookies without an explicit SameSite attribute are not included in cross-site POST requests. - As a result, the server receives requests without the session cookie and returns HTTP 401 Unauthorized. | Scenario | Exploitable | |----------|-------------| | Cross-site HTML (modern browsers) | ✗ Blocked by SameSite=Lax | |…
Recommended action: Upgrade to 0.0.0-20260609084633-98122fa4d110 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/komari-monitor/komari < 0.0.0-20250809064056-cc3d54bff4c6
Fixed in
0.0.0-20250809064056-cc3d54bff4c6· Vendor fix available
Issue
Logic error in 2FA verification condition allows bypass of two-factor authentication Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/login.go#L55 There is no way for Verify2Fa to return an error AND true as ok at the same time, any codes are considered as valid. PoC Use any 6 digits as 2FA code Impact Bypass 2FA Authentication
Recommended action: Upgrade to 0.0.0-20250809064056-cc3d54bff4c6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/komari-monitor/komari < 0.0.0-20250809073044-53171affcaf0
Fixed in
0.0.0-20250809073044-53171affcaf0· Vendor fix available
Issue
WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35 Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution PoC 1. Login in to your komari instance 2. Hosting the following HTML code on internet, replace <komari-addr and <target-uuid into yours 3. Visit this HTML page, you can see your node is executing uptime without your actions Impact An administrator of a Komari instance will execute commands on their nodes unnoticed when visiting a malware page.
Recommended action: Upgrade to 0.0.0-20250809073044-53171affcaf0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.