github.com/0xJacky/Nginx-UI
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- affected by 13 advisory(ies)
Advisories (72)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2gc7-j998-5xx6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-32gc-wf3m-78w9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728091109-0ecbd106c37b | Undetermined |
| GHSA-33rr-wq23-g6gg Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GHSA-45gv-9wjv-xh7p Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074558-95cd21b70814 | Undetermined |
| GHSA-5r62-gj48-897x Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-5v7c-xpfp-p65m Nginx UI OTP secure-session step-up is missing on sensitive mutation routes | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-662p-52hx-cmh2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728114330-580585516dd8 | Undetermined |
| GHSA-76pm-mq2q-9gcr Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-78mf-482w-62qj Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints | < 1.9.10-0.20260316053337-1a9cd29a3082 | Undetermined |
| GHSA-7jrr-xw9c-mj39 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback | ≤ 1.9.9 | Undetermined |
| GHSA-8r25-68wm-jw35 Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) | < 1.9.10-0.20231219184941-827e76c46e63 | Undetermined |
| GHSA-9h23-53f4-q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout | 1.9.10-0.20251005005631-6de168c9454 – < 1.9.10-0.20260904075558-e30e331303fc | Undetermined |
| GHSA-9jww-cxg5-rj9m Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE | 1.9.10-0.20250506154222-1330888280a2 – < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-cf23-7qxj-xmhr Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-cp8r-8jvw-v3qg nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval | ≤ 1.99 | Undetermined |
| GHSA-fhh2-gg7w-gwpq nginx-ui Backup Restore Allows Tampering with Encrypted Backups | < 1.9.10-0.20260315015203-f61bcec547c0 | Undetermined |
| GHSA-g9w5-qffc-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure | < 2.3.3 | Undetermined |
| GHSA-h246-wpgf-vmq5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GHSA-h27v-ph7w-m9fp Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim | 2.0.0 – < 2.3.8 | Undetermined |
| GHSA-h374-mm57-879c Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) | < 1.9.10-0.20231219195202-ec93ab05a3ec | Undetermined |
| GHSA-h6c2-x2m2-mwhf nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover | ≤ 1.99 | Undetermined |
| GHSA-j3hg-9rp3-5hw9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage | 1.9.10-0.20260729084040-acb59fdd81db – < 1.9.10-0.20260901043436-8c9b9a1aff21 | Undetermined |
| GHSA-jrq7-xrjx-pcfw Nginx UI: Auto backup name allows path traversal outside validated storage path | < 1.9.10-0.20260715121709-f92218e01054 | Undetermined |
| GHSA-m468-xcm6-fxg4 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse | ≤ 1.99 | Undetermined |
| GHSA-m8p8-53vf-8357 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation | ≤ 1.99 | Undetermined |
| GHSA-p393-cf76-4jmr Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite | 1.9.10-0.20260421071512-7864e378f5cf – < 1.9.10-0.20260728074146-a467ed652591 | Undetermined |
| GHSA-p8v3-89rh-jxc7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074146-a467ed652591 | Undetermined |
| GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GHSA-pxmr-q2x3-9x9m Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) | < 1.9.10-0.20231219184941-827e76c46e63 | Undetermined |
| GHSA-qcjq-7f7v-pvc8 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF | < 1.9.10-0.20240126104956-d70e37c8575e | Undetermined |
| GHSA-vc32-4gwf-77xp Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-wq4w-vwvq-q3x9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GHSA-wr32-99hh-6f35 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services | ≤ 2.3.4 | Undetermined |
| GHSA-x234-x5vq-cc2v Nginx-UI: Disabled users retain full API access through previously issued bearer tokens | < 1.9.10-0.20260314152518-7b66578adb47 | Undetermined |
| GHSA-xvq9-4vpv-227m Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature | < 1.9.10-0.20240128060047-8581bdd3c6f4 | Undetermined |
| GO-2024-2462 Arbitrary command execution in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20231219184941-827e76c46e63 | Undetermined |
| GO-2024-2463 SQL injection in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20231219195202-ec93ab05a3ec | Undetermined |
| GO-2024-2464 Remote command execution in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20231219184941-827e76c46e63 | Undetermined |
| GO-2024-2480 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2024-2481 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4614 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4902 nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4903 nginx-ui Backup Restore Allows Tampering with Encrypted Backups in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4904 nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4906 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-4907 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-5210 Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260316053337-1a9cd29a3082 | Undetermined |
| GO-2026-5227 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-5412 Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-5719 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-5733 Nginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260314152518-7b66578adb47 | Undetermined |
| GO-2026-6702 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728091109-0ecbd106c37b | Undetermined |
| GO-2026-6703 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GO-2026-6704 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074558-95cd21b70814 | Undetermined |
| GO-2026-6705 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728114330-580585516dd8 | Undetermined |
| GO-2026-6706 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GO-2026-6707 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074146-a467ed652591 | Undetermined |
| GO-2026-6708 Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250517140552-daee3ac7ade1 – < 1.9.10-0.20260728074433-a3999bd78a3b | Undetermined |
| GO-2026-6724 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260904075558-e30e331303fc | Undetermined |
| GO-2026-6734 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI | 1.9.10-0.20260729084040-acb59fdd81db – < 1.9.10-0.20260901043436-8c9b9a1aff21 | Undetermined |
| GO-2026-6741 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI | 1.9.10-0.20260421071512-7864e378f5cf – < 1.9.10-0.20260728074146-a467ed652591 | Undetermined |
| GO-2026-6771 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6773 Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-6774 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6775 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6779 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6781 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE in github.com/0xJacky/Nginx-UI | 1.9.10-0.20250506154222-1330888280a2 – < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6782 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6786 TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI | * | Affected |
| GO-2026-6788 Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260715121709-f92218e01054 | Undetermined |
| GO-2026-6799 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
| GO-2026-6801 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260703131214-23d1934099b0 | Undetermined |
Sources
| Source | Licence |
|---|