Is github.com/getarcaneapp/arcane/backend safe ? github.com/getarcaneapp/arcane/backend (go) has 10 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 33rd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-7h26-hg47-p9hx, the advisory selected below
// 10 advisories GHSA-7h26-hg47-p9hx Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source… CRIT GHSA-gjqq-6r35-w3r8 Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed… CRIT GHSA-c3px-h233-h6fq ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any… HIGH GHSA-jpjh-jm2p-39hh The PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's… HIGH GHSA-q2pj-8v84-9mh5 The unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll… HIGH GHSA-cxx3-hr75-4q96 Four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client… HIGH GHSA-ff24-4prj-gpmj The /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and… HIGH GHSA-9mvm-4gwg-v8mp GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane… MODE GHSA-pw5q-rjx4-7f7p Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in… UNKN GHSA-mp22-58ff-6fhr Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend UNKN Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source…
Full advisory text at GitHub advisory , NVD or OSV .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High // questions Is github.com/getarcaneapp/arcane/backend safe to install? CyberXYZ does not call a package safe in absolute terms. It records 10 known vulnerabilities for github.com/getarcaneapp/arcane/backend (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/getarcaneapp/arcane/backend have known vulnerabilities? Yes. CyberXYZ records 10 known vulnerabilities for github.com/getarcaneapp/arcane/backend (go), the worst rated CRITICAL. These include GHSA-7h26-hg47-p9hx, GHSA-gjqq-6r35-w3r8, GHSA-c3px-h233-h6fq, GHSA-jpjh-jm2p-39hh, GHSA-q2pj-8v84-9mh5.
How do I check github.com/getarcaneapp/arcane/backend before installing? Search github.com/getarcaneapp/arcane/backend in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fgetarcaneapp%2Farcane%2Fbackend . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-15 at 08:08 UTC. The most recent advisory here was published 2026-10-19. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page