VYPR
Get started
← All advisories
Critical severity9.4NVD Advisory· Published May 6, 2025· Updated Apr 15, 2026

CVE-2025-46816

CVE-2025-46816

Description

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/patrickhener/goshsGo
>= 0.3.4, < 1.0.51.0.5

Patches

2
1eb190b81f7a
https://github.com/patrickhener/goshsvia osv
160220974576

Address security issue

https://github.com/patrickhener/goshsPatrick HenerMay 6, 2025via ghsa
commit
3 files changed · +18 −12
  • httpserver/server.go+1 −1 modified
    @@ -220,7 +220,7 @@ func (fs *FileServer) Start(what string) {
 		fs.Clipboard = clipboard.New()
 
 		// init websocket hub
-		fs.Hub = ws.NewHub(fs.Clipboard)
+		fs.Hub = ws.NewHub(fs.Clipboard, fs.CLI)
 		go fs.Hub.Run()
 	}
  • ws/client.go+12 −10 modified
    @@ -111,17 +111,19 @@ func (c *Client) dispatchReadPump(packet Packet) {
 		c.refreshClipboard()
 
 	case "command":
-		var command string
-		if err := json.Unmarshal(packet.Content, &command); err != nil {
-			logger.Errorf("Error reading json packet: %+v", err)
-		}
-		logger.Debugf("Command was: %+v", command)
-		output, err := cli.RunCMD(command)
-		if err != nil {
-			logger.Errorf("Error running command: %+v", err)
+		if c.hub.cliEnabled {
+			var command string
+			if err := json.Unmarshal(packet.Content, &command); err != nil {
+				logger.Errorf("Error reading json packet: %+v", err)
+			}
+			logger.Debugf("Command was: %+v", command)
+			output, err := cli.RunCMD(command)
+			if err != nil {
+				logger.Errorf("Error running command: %+v", err)
+			}
+			logger.Debugf("Output: %+v", output)
+			c.updateCLI(output)
 		}
-		logger.Debugf("Output: %+v", output)
-		c.updateCLI(output)
 
 	default:
 		logger.Warnf("The event sent via websocket cannot be handeled: %+v", packet.Type)
  • ws/hub.go+5 −1 modified
    @@ -21,16 +21,20 @@ type Hub struct {
 
 	// Handle clipboard
 	cb *clipboard.Clipboard
+
+	// CLI Enabled
+	cliEnabled bool
 }
 
 // NewHub will create a new hub
-func NewHub(cb *clipboard.Clipboard) *Hub {
+func NewHub(cb *clipboard.Clipboard, cliEnabled bool) *Hub {
 	return &Hub{
 		broadcast:  make(chan []byte),
 		register:   make(chan *Client),
 		unregister: make(chan *Client),
 		clients:    make(map[*Client]bool),
 		cb:         cb,
+		cliEnabled: cliEnabled,
 	}
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.