Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
Update github.com/mattermost/mattermost-plugin-github to 1.0.1-0.20260330164815-c2840e980b3c; github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't validate user-supplied input in API request handlers affects github.com/mattermost/mattermost-plugin-github (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go). Severity is medium. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
Update github.com/mattermost/mattermost-plugin-github to 1.0.1-0.20260330164815-c2840e980b3c; github.com/mattermost/mattermost-server to 11.6.1; github.com/mattermost/mattermost-server to 11.5.4; github.com/mattermost/mattermost-server to 11.4.5; github.com/mattermost/mattermost-server to 10.11.15 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMattermost doesn't validate user-supplied input in API request handlers affects github.com/mattermost/mattermost-plugin-github (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go). Severity is medium. Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
| github.com/mattermost/mattermost-plugin-githubgo | <1.0.1-0.20260330164815-c2840e980b3c | 1.0.1-0.20260330164815-c2840e980b3c |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
|---|
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
|---|
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| github.com/mattermost/mattermost-plugin-githubgo | <1.0.1-0.20260330164815-c2840e980b3c | 1.0.1-0.20260330164815-c2840e980b3c |
|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
|---|
| github.com/mattermost/mattermost-servergo | >=11.5.0,<11.5.4 | 11.5.4 |
|---|
| github.com/mattermost/mattermost-servergo | >=11.4.0,<11.4.5 | 11.4.5 |
|---|
| github.com/mattermost/mattermost-servergo | >=10.11.0,<10.11.15 | 10.11.15 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard