xyproto/algernon Security Advisories | GitStock

high2026-07-02

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

GHSA-mm6c-5j6x-hq8m · CVE-2026-52792

high2026-06-23

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

GHSA-jc3j-x6pg-4hmv · CVE-2026-48126

medium2026-05-20

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

GHSA-hw27-4v2q-5qff · CVE-2026-46431

medium2026-05-20

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

GHSA-gj84-924c-48fx · CVE-2026-46430

medium2026-05-19

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

GHSA-9v4j-7g44-qcqw

critical2026-05-19

Algernon: handler.lua discovery walks parent directories above the server root

GHSA-xwcr-wm99-g9jc · CVE-2026-45721

high2026-05-19

Algernon: Single-file mode unconditionally enables debug mode

GHSA-fwqx-8365-9983 · CVE-2026-45728

medium2025-12-10

Algernon Cross-Site Scripting vulnerability

GHSA-8jqm-8qm3-qgqm · CVE-2025-65754

medium2023-05-31

Algernon engine and themes vulnerable to Cross-site Scripting

GHSA-g47h-fgcw-g4ph · CVE-2023-26131