Algernon Cross-Site Scripting vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-65754 · ADVISORY
• xyproto/algernon commit cd88320 · WEB
• gist.github.com/Bnyt7/0faa90ff93c5d98093a0e29a1eb34d81 · WEB
• Bnyt7/CVE-2025-65754 · WEB
• xyproto/algernon · PACKAGE
• GitHub Advisory GHSA-8jqm-8qm3-qgqm · ADVISORY

More vulnerabilities in github.com/xyproto/algernon

• CVE-2026-52792HIGH 8.7Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by …
• GO-2026-5300Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xypr…
• CVE-2026-48126HIGH 8.2Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which sile…
• CVE-2026-46431MEDIUM 4.3Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header w…
• CVE-2026-46430MEDIUM 4.3Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default…