Is github.com/bishopfox/sliver safe ? github.com/bishopfox/sliver (go) has 12 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 370 direct dependencies
35 carry known advisories, worst CRITICAL
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10; GitHub rates it CRITICAL
epss chance of exploitation in 30 days, 49th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-8jxm-xp43-qh3q, the advisory selected below
// 12 advisories GHSA-8jxm-xp43-qh3q The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes… CRIT GHSA-c279-989m-238f A nil pointer dereference in tunnelCloseHandler causes the handler goroutine to panic whenever a reverse tunnel (rportfwd) close is attempted. HIGH GHSA-2phg-qgmm-r638 GzipEncoder does not limit output size when processing compressed data. HIGH GHSA-wxrw-gvg8-fqjp The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP… HIGH GHSA-hc5w-gxxr-w8x8 Sliver version 1.6.0 (prerelease) is vulnerable to RCE on the teamserver by a low-privileged "operator" user. HIGH GHSA-6fpf-248c-m7wm A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating… MODE GHSA-97vp-pwqj-46qc A Remote OOM (Out-of-Memory) vulnerability exists in the Sliver C2 server's mTLS and WireGuard C2 transport layer. MODE GHSA-2286-hxv5-cmp2 A Path Traversal vulnerability in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. MODE GHSA-hjr9-wj7v-7hv8 A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where startSessionHandler() reads the entire request body without limits… MODE GHSA-q8j9-34qf-7vq7 Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: MODE GHSA-fh4v-v779-4g2w The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator… MODE GHSA-hx52-cv84-jr5v A vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. LOW The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes…
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is github.com/bishopfox/sliver safe to install? CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for github.com/bishopfox/sliver (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/bishopfox/sliver have known vulnerabilities? Yes. CyberXYZ records 12 known vulnerabilities for github.com/bishopfox/sliver (go), the worst rated CRITICAL. These include GHSA-8jxm-xp43-qh3q, GHSA-c279-989m-238f, GHSA-2phg-qgmm-r638, GHSA-wxrw-gvg8-fqjp, GHSA-hc5w-gxxr-w8x8.
How do I check github.com/bishopfox/sliver before installing? Search github.com/bishopfox/sliver in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fbishopfox%2Fsliver . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:45 UTC. The most recent advisory here was published 2026-03-31. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page