Open-source package vulnerability · Go

CVE-2025-46816: goshs route not protected, allows command execution

criticalCVSS 3.0 9.4GHSA-rwj2-w85g-5cmm

Summary It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4. Details It seems that the function does not checks the option cli , thus allowing anyone to execute arbitrary command through the use of websockets.

Published May 6, 2025

Affected packages

github.com/patrickhener/goshs

Ecosystem: Go
Affected: >= 0.3.4, <= 1.0.4
Fixed in: 1.0.5
Check: go list -m github.com/patrickhener/goshs

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4.

Details

It seems that the function ``dispatchReadPump` does not checks the option cli `-c``, thus allowing anyone to execute arbitrary command through the use of websockets.

PoC

Used websocat for the POC:

echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t

Impact

The vulnerability will only impacts goshs server on vulnerable versions.

Credited to Guilhem7.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries