Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/lin-snow/Ech0 < 1.4.8-0.20260503041146-eab62379c795
Fixed in
1.4.8-0.20260503041146-eab62379c795· Vendor fix available
Issue
Access tokens created with the "never expire" option have no exp JWT claim. Three independent revocation mechanisms fail for this token type. Logout at internal/handler/auth/auth.go:154 and :163 dereferences claims.ExpiresAt.Time, panicking on the nil field so the token never hits the blacklist. RevokeToken at internal/repository/auth/auth.go:45-50 skips when remainTTL <= 0. The admin's "Delete token" panel action at internal/service/setting/accesstokenservice.go:183-185 removes the database record but does not call RevokeToken to blacklist the JTI. Once a never-expire token leaks, the JWT stays cryptographically valid until the admin rotates the signing key across the entire instance. Details Creation path at internal/util/jwt/jwt.go:103-105: For NEVEREXPIRY, expiry = 0 and the conditional skips. The resulting JWT has no exp claim. The middleware at internal/middleware/auth.go accepts it; the jwt/v5 parser does not require exp by default. Failure mode 1, logout panic at…
Recommended action: Upgrade to 1.4.8-0.20260503041146-eab62379c795 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lin-snow/Ech0 < 1.4.8-0.20260503040728-a7e8b8e84bd1
Fixed in
1.4.8-0.20260503040728-a7e8b8e84bd1· Vendor fix available
Issue
parseAndValidateClientRedirect at internal/service/auth/auth.go:448 validates OAuth client-redirect URIs by comparing only scheme and host against the admin-configured allowlist. Path, query, and fragment are ignored. The initiator at /oauth/:provider/login embeds the caller-supplied redirecturi verbatim into the signed state JWT without any validation at login time. Alice submits a crafted redirecturi whose host matches an allowed origin but whose path points to any page on that host. After the provider exchange, Ech0 redirects the victim to the attacker-chosen path with the one-time exchange code in the query string. If the chosen path leaks the URL via Referer, analytics, or an open redirect, the attacker trades the code at POST /api/auth/exchange for the victim's access and refresh tokens. RFC 6749 §3.1.2 requires exact redirect URI matching. Details Validation at internal/service/auth/auth.go:448: Scheme and host compared via EqualFold. Path, query, fragment all ignored.…
Recommended action: Upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lin-snow/Ech0 < 1.4.8-0.20260503035905-cecc2c19b590
Fixed in
1.4.8-0.20260503035905-cecc2c19b590· Vendor fix available
Issue
PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the favcount counter on any echo (including private echoes) by UUID, repeat the request without deduplication, and trigger a database write plus a four-key cache invalidation on every call. Alice harvests echo UUIDs from the public GET /api/echo/page response, inflates fav counts at will, and spams writes to amplify load on the DB and cache layers. Details Route registration at internal/router/echo.go:12: PublicRouterGroup is r.Group("/api") without the JWT middleware that AuthRouterGroup applies. The handler passes through to EchoService.LikeEcho, which calls EchoRepository.LikeEcho at internal/repository/echo/echo.go:270: No viewer check, no ownership check, no private-flag check. Compare the read path at EchoService.GetEchoById (internal/service/echo/echo.go:275-300) which rejects anonymous readers on private echoes;…
Recommended action: Upgrade to 1.4.8-0.20260503035905-cecc2c19b590 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lin-snow/Ech0 < 1.4.8-0.20260503035519-fd320fe3e902
Fixed in
1.4.8-0.20260503035519-fd320fe3e902· Vendor fix available
Issue
The public RSS/Atom feed at /rss renders two attacker-controlled surfaces without HTML escaping. Tag names flow through fmt.Appendf(renderedContent, "<br /<span class=\"tag\"#%s</span", tag.Name) at internal/service/common/common.go:120, and the Markdown renderer at internal/util/md/md.go does not set the html.SkipHTML flag, so raw HTML blocks in echo content pass through unmodified. The resulting Atom <summary type="html" is valid XML but contains executable <script tags after the RSS reader decodes it. RSS subscribers whose readers render HTML (including many self-hosted and desktop clients) execute attacker JavaScript in the reader's origin. Details Tag sink at internal/service/common/common.go:120: fmt.Appendf with %s does not HTML-escape. Tag names come from user-supplied EchoUpsertDto.Tags and are persisted after strings.TrimSpace(strings.TrimPrefix(tag.Name, "#")) at internal/service/echo/echo.go:326, which strips a leading and trims whitespace but does nothing about…
Recommended action: Upgrade to 1.4.8-0.20260503035519-fd320fe3e902 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lin-snow/Ech0 < 1.4.8-0.20260503034700-cb8d7a997dd8
Fixed in
1.4.8-0.20260503034700-cb8d7a997dd8· Vendor fix available
Issue
The Comment model serializes its Email field through the public comment-listing API. internal/model/comment/comment.go:33 uses json:"email", while adjacent PII fields (IPHash, UserAgent) correctly use json:"-". The public endpoints GET /api/comments?echoid=X and GET /api/comments/public?limit=N both live on PublicRouterGroup with no authentication. Alice retrieves every guest commenter's email address on the instance with a few unauthenticated HTTP calls. Details The Comment model at internal/model/comment/comment.go:33: The json:"-" on IPHash and UserAgent shows the developer's intent: hide server-side PII from API responses. The Email field missed the same tag. GORM materializes the full struct and the Gin handler returns it verbatim. Routes at internal/router/comment.go:20 and comment public-feed route: Both handlers call ListPublicByEchoID (service at internal/service/comment/comment.go:329) or ListPublicComments (service at :340), both of which return the slice of…
Recommended action: Upgrade to 1.4.8-0.20260503034700-cb8d7a997dd8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.