{"answers":{"affected":"3 open source packages ship an affected version, including github.com/jub0bs/fcors.","exploited":"There is no known exploitation of GHSA-v84h-653v-4pq9 in the wild and no public exploit code.","fix":"Upgrade github.com/jub0bs/fcors to 0.9.0 or later.","what":"GHSA-v84h-653v-4pq9 is a vulnerability in github.com/jub0bs/fcors, published on 3 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-v84h-653v-4pq9 and fix it if it is affected.\n\nWhat it is: GHSA-v84h-653v-4pq9 is a vulnerability in github.com/jub0bs/fcors, published on 3 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-v84h-653v-4pq9 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/jub0bs/fcors (Go): affected all versions; fixed in 0.9.0\n- github.com/jub0bs/fcors (Go): affected all versions; fixed in 0.9.0\n- github.com/jub0bs/fcors (Go): affected all versions; fixed in 0.9.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-v84h-653v-4pq9/ (Markdown: https://insights.sbomify.com/GHSA-v84h-653v-4pq9/index.md)","id":"GHSA-v84h-653v-4pq9","markdown":"https://insights.sbomify.com/GHSA-v84h-653v-4pq9/index.md","name":"GHSA-v84h-653v-4pq9","record":{"aliases":["GO-2024-2812"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Go CORS middleware","requires_auth":"none","summary":"CORS middleware incorrectly allows untrusted origins when multiple patterns share a suffix, enabling cross-origin attacks.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Some CORS middleware allow untrusted origins","id":"GHSA-v84h-653v-4pq9","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.9.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jub0bs/fcors","purl":null,"source":"GHSA-v84h-653v-4pq9"},{"ecosystem":"Go","fixed":["0.9.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jub0bs/fcors","purl":"pkg:golang/github.com/jub0bs/fcors","source":"GHSA-v84h-653v-4pq9"},{"ecosystem":"Go","fixed":["0.9.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jub0bs/fcors","purl":"pkg:golang/github.com/jub0bs/fcors","source":"GO-2024-2812"}],"products":null,"published":"2024-05-03","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"CORS middleware incorrectly allows untrusted origins when multiple patterns share a suffix, enabling cross-origin attacks.","url":"https://insights.sbomify.com/GHSA-v84h-653v-4pq9/"}