Open-source package vulnerability · Go
CVE-2026-39087: ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
criticalCVSS 3.1 9.8GHSA-pqhx-w72w-m393
An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.
Published Apr 23, 2026 · Updated May 8, 2026
Affected packages
heckel.io/ntfy/v2
- Ecosystem
- Go
- Affected
- < 2.22.0
- Fixed in
- 2.22.0
- Check
go list -m heckel.io/ntfy/v2
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology