github.com/astaxie/beego v1.12.3
PkgFire would install this release with a warning.·Checked 12 hours ago·Published 3 November 2020
Why
-
warnLikely exploited
Access control bypass due to broad route matching in github.com/beego/beego and beego/v2 EPSS puts the chance of exploitation in the next 30 days at 22% (higher than 98% of all scored vulnerabilities). That is a forecast, not an observation, so it raises this finding rather than blocking it.
-
warnVulnerability
Path traversal in github.com/beego/beego and beego/v2
-
warnVulnerability
Access control bypass via incorrect route lookup in github.com/beego/beego and beego/v2
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Source patterns
Patterns found in the source, including those malware is known to use.
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.