CVE-2024-28892: GoCast OS Command Injection vulnerability
An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Published Dec 20, 2024 · Updated Dec 26, 2024
Affected packages
github.com/mayuresh82/gocast
- Ecosystem
- Go
- Affected
- <= 1.1.3
- Fixed in
- No patched version yet
- Check
go list -m github.com/mayuresh82/gocast
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Credited to Malayke.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology