Is github.com/juev/nebula-mesh safe ? github.com/juev/nebula-mesh (go) has 14 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 42nd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-598g-h2vc-h5vg, the advisory selected below
// 14 advisories GHSA-598g-h2vc-h5vg The /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. CRIT GHSA-c6v2-3ffm-vcmc The web UI (/ui/) does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. HIGH GHSA-7hp6-g3pq-3pc3 internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the… HIGH GHSA-qm33-p5p9-f8vg internal/api/audit.go:12 — handleGetAuditLog does no admin check. HIGH GHSA-w7w5-5gcp-38rw None of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. HIGH GHSA-273q-qgh5-wrj6 Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. HIGH GHSA-ghmh-jhmj-wcmf internal/store/sqlite.go:1177,1192,1221,1245 — the enrollmenttokens.token column holds the raw UUID token. MODE GHSA-8h84-fhqq-q58v internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16… MODE GHSA-rqfj-vv8r-xhqc internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. MODE GHSA-9pg3-25fq-p6cc internal/web/operators.go:251 — after handleOperatorCreateAPIKey mints a fresh 32-byte bearer token, the redirect points the operator's browser at: MODE Show all 14 advisories The /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints.
Full advisory text at GitHub advisory , NVD or OSV .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High // questions Is github.com/juev/nebula-mesh safe to install? CyberXYZ does not call a package safe in absolute terms. It records 14 known vulnerabilities for github.com/juev/nebula-mesh (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/juev/nebula-mesh have known vulnerabilities? Yes. CyberXYZ records 14 known vulnerabilities for github.com/juev/nebula-mesh (go), the worst rated CRITICAL. These include GHSA-598g-h2vc-h5vg, GHSA-c6v2-3ffm-vcmc, GHSA-7hp6-g3pq-3pc3, GHSA-qm33-p5p9-f8vg, GHSA-w7w5-5gcp-38rw.
How do I check github.com/juev/nebula-mesh before installing? Search github.com/juev/nebula-mesh in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fjuev%2Fnebula-mesh . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 05:21 UTC. The most recent advisory here was published 2026-07-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page