Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
go package report
Is github.com/Xhofe/alist safe?
1 known vulnerability, worst severity MODERATE.
// reach
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss
0.0
medium
severity band, no base score published
epss
0.00%
medium
chance of exploitation in 30 days, 52nd percentile of all CVEs
xyz score
not scored
CyberXYZ composite out of 10
fig. 01 â GHSA-jpj5-hg26-6jgc, the advisory selected below
// 1 advisories
Checked 2026-10-01 at 00:02 UTC. The most recent advisory here was published 2022-03-13. Updated continuously from NVD, GHSA, OSV and CNA feeds.