~ / search / GHSA-pqhx-w72w-m393

GHSA-pqhx-w72w-m393

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-39087

Packages

EcosystemPackageAffectedFixed in
Go heckel.io/ntfy/v2 < 2.22.0 2.22.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.

References

External links from the advisory. They lead to third-party sites.