Critical severity9.4OSV Advisory· Published May 6, 2025· Updated Apr 15, 2026
CVE-2025-46816
CVE-2025-46816
Description
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/patrickhener/goshsGo | >= 0.3.4, < 1.0.5 | 1.0.5 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/patrickhener/goshspkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 0.3.4, < 1.0.5+ 1 more
- (no CPE)range: >= 0.3.4, < 1.0.5
- (no CPE)range: < 0.0.20250515T200012-1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.