Go-shiori vulnerabilities
We track 3 vulnerabilities in Go-shiori products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
Latest Go-shiori vulnerabilities
- 8.5 High severity
shiori: Server-Side Request Forgery
go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).
- 8.3 High severity
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC…
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in
- 8.8 High severity
shiori: Improper Privilege Management
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner