{"schema":"threatline.record/2","record":{"id":"GHSA-mqv7-9mvf-h9fh","aliases":["GHSA-mqv7-9mvf-h9fh"],"summary":" unauthenticated Go source injection via public auto-code routes (initMenu/initAPI/initDictionary)","details":"Impact\r\n\r\nThree publicly accessible auto-code endpoints (initMenu, initAPI, and initDictionary) are exposed without authentication or authorization. User-controlled request parameters are interpolated directly into generated Go source code without escaping, allowing an unauthenticated attacker to inject arbitrary Go code into generated files that are subsequently compiled by the application. The same endpoints also allow path traversal through the PlugName parameter, enabling writes outside the repository root.\r\n\r\nAdditional issues include:\r\n\r\nArbitrary directory deletion via the removePlugin endpoint due to insufficient validation of pluginName.\r\nStored XSS through unrestricted HTML uploads, which can lead to token theft because authentication cookies are not configured with HttpOnly or Secure attributes.\r\nMultiple additional unauthenticated endpoints, including policy reload, LLM proxy access, and error log writing.\r\n\r\nThese vulnerabilities affect all deployments using the vulnerable versions of gin-vue-admin, especially projects exposing the API to untrusted networks.\r\n\r\nPatches\r\n\r\nThe issues have been fixed in the following releases:\r\n\r\nv2.9.3\r\nv3.0.1 (or the first patched 3.x release)\r\n\r\nUsers should upgrade to one of these versions or any later release.\r\n\r\nThe fixes include:\r\n\r\nMoving the auto-code initialization endpoints behind authentication and Casbin authorization.\r\nProperly escaping generated Go source (using safe string quoting instead of direct fmt.Sprintf interpolation).\r\nValidating plugin names before any filesystem operations.\r\nPreventing path traversal in plugin removal.\r\nRestricting uploadable file types and improving upload security.\r\nSetting secure cookie attributes where applicable.\r\nWorkarounds\r\n\r\nIf upgrading is not immediately possible, administrators should:\r\n\r\nDisable or remove the public initMenu, initAPI, and initDictionary routes.\r\nPlace all auto-code endpoints behind authentication and authorization.\r\nRestrict access to the API using firewalls or reverse proxy rules so only trusted administrators can reach these endpoints.\r\nDisable the plugin upload feature or reject HTML and other executable file types.\r\nValidate plugin names against a strict allowlist before performing filesystem operations.\r\nConfigure authentication cookies with the HttpOnly and Secure attributes.\r\n\r\nThese mitigations reduce exposure but do not completely eliminate all affected attack paths. Upgrading is strongly recommended.","categories":["Frameworks"],"product":"gin-vue-admin","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-mqv7-9mvf-h9fh","source_modified_at":"2026-10-16T02:48:18Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"name":"gin-vue-admin","ecosystem":null},"range":"<2.9.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-mqv7-9mvf-h9fh","source_modified_at":"2026-10-16T02:48:18Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"name":"gin-vue-admin","ecosystem":null},"version":"2.9.2"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-16T02:48:18Z","modified_at":"2026-10-16T02:48:18Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-mqv7-9mvf-h9fh","fetched_at":"2026-10-23T19:00:29.328130Z","source_modified_at":"2026-10-16T02:48:18Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-16T02:48:18Z","content_hash":"8e9f97d5a243b09cec711e14d295fcc5dd2bc53312ac0e47f46d89f2cdd6dcac"}}