How severe is GHSA-55f6-4pr5-c7m5?

No CVSS score has been assigned to GHSA-55f6-4pr5-c7m5 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-55f6-4pr5-c7m5?

GHSA-55f6-4pr5-c7m5 affects the following packages: github.com/kahiteam/kahi (Go). Ecosystems affected: Go.

How do I fix GHSA-55f6-4pr5-c7m5?

Update github.com/kahiteam/kahi to 0.1.0-alpha.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-55f6-4pr5-c7m5 is resolved across your whole dependency graph.

How do I detect GHSA-55f6-4pr5-c7m5 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/kahiteam/kahi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-55f6-4pr5-c7m5 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-55f6-4pr5-c7m5 actively exploited in the wild?

No public exploit code has been indexed for GHSA-55f6-4pr5-c7m5 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-55f6-4pr5-c7m5 published, and has it been updated?

GHSA-55f6-4pr5-c7m5 was published on June 30, 2026 and was last updated on July 7, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

Not in CISA KEV

Kahi has privilege-drop and socket/log permission issuesGHSA-55f6-4pr5-c7m5

GHSA-55f6-4pr5-c7m5 is a security vulnerability in github.com/kahiteam/kahi. A fix is available for github.com/kahiteam/kahi — see the affected versions and patch details below.

Also known asGO-2026-5847

Published

Jun 30, 2026

Updated

Jul 7, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jul 7, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/kahiteam/kahi

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Kahi releases up to and including v0.1.0-alpha.8 contain three privilege/permission issues, all fixed in v0.1.0-alpha.9. They were identified in a full-codebase security review on 2026-05-26.

Affected versions

All releases <= v0.1.0-alpha.8.

Patched version

v0.1.0-alpha.9.

Details

1. Per-process privilege drop not applied (High)

A process configured with user = "uid:gid" had its credential resolved but never attached to the spawned child, so the process ran with the supervisor's inherited privileges (root, when the supervisor runs as root) instead of the configured lower-privilege user. The intended privilege isolation did not occur, and no error was raised.

2. Privilege drop did not reset supplementary groups (Medium)

When the daemon dropped privileges it set the primary gid and uid but never called setgroups(2), so the launching user's supplementary groups (for example docker, which is root-equivalent) remained active after the drop and were inherited by child processes.

3. FastCGI unix socket world-accessible by default (Medium)

A FastCGI unix-domain socket was chmod-ed only when socket_mode was explicitly configured. With socket_mode unset the socket kept the umask-dependent default (commonly world-accessible), allowing any local user to connect to it.

Remediation

Upgrade to v0.1.0-alpha.9. Privilege handling is now fail-closed: the configured credential is applied or the process refuses to start, supplementary groups are reset via setgroups before setgid/setuid, and FastCGI unix sockets default to 0700.

Workarounds (for <= v0.1.0-alpha.8)

Do not rely on per-process user; run the supervisor directly as the intended unprivileged user.
Set an explicit restrictive socket_mode on FastCGI programs.
Avoid running the supervisor as root where possible.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/kahiteam/kahi`	all versions	0.1.0-alpha.9`go get github.com/kahiteam/kahi@v0.1.0-alpha.9`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/kahiteam/kahi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/kahiteam/kahi to 0.1.0-alpha.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-55f6-4pr5-c7m5 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

Kahi releases up to and including v0.1.0-alpha.8 contain three privilege/permission issues, all fixed in v0.1.0-alpha.9. They were identified in a full-codebase security review on 2026-05-26. ## Affected versions All releases <= v0.1.0-alpha.8. ## Patched version v0.1.0-alpha.9. ## Details ### 1. Per-process privilege drop not applied (High) A process configured with `user = "uid:gid"` had its credential resolved but never attached to the spawned child, so the process ran with the supervisor's inherited privileges (root, when the supervisor runs as root) instead of the configured lower-pri

O3 Security · Impact-Aware SCA

Is GHSA-55f6-4pr5-c7m5 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works