### Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the `app.ini` via CRLF to change the value of `test_config_cmd` and `start_cmd` resulting in an Authenticated RCE ### Impact Authenticated Remote execution on the host
Update github.com/0xJacky/Nginx-UI to 1.9.10-0.20240126104956-d70e37c8575e if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF affects github.com/0xJacky/Nginx-UI (go). Severity is high. ### Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the `app.ini` via CRLF to change the value of `test_config_cmd` and `start_cmd` resulting in an Authenticated RCE ### Impact Authenticated Remote execution on the host
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/0xJacky/Nginx-UIgo | <1.9.10-0.20240126104956-d70e37c8575e |
### Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the `app.ini` via CRLF to change the value of `test_config_cmd` and `start_cmd` resulting in an Authenticated RCE ### Impact Authenticated Remote execution on the host
Update github.com/0xJacky/Nginx-UI to 1.9.10-0.20240126104956-d70e37c8575e if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF affects github.com/0xJacky/Nginx-UI (go). Severity is high. ### Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the `app.ini` via CRLF to change the value of `test_config_cmd` and `start_cmd` resulting in an Authenticated RCE ### Impact Authenticated Remote execution on the host
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/0xJacky/Nginx-UIgo | <1.9.10-0.20240126104956-d70e37c8575e |
| 1.9.10-0.20240126104956-d70e37c8575e |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| 1.9.10-0.20240126104956-d70e37c8575e |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard