Go/github.com/dagu-org/dagu CVE-2026-31886: critical 9.1, EPSS 0.44%

Dagu: Path Traversal via `dagRunId` in Inline DAG Execution

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-m4q3-457p-hh2x
• https://github.com/dagu-org/dagu/security/advisories/GHSA-m4q3-457p-hh2x
• https://nvd.nist.gov/vuln/detail/CVE-2026-31886
• https://github.com/dagu-org/dagu/commit/12c2e5395bd9331d49ca103593edfd0db39c4f38
• https://github.com/dagu-org/dagu
• https://pkg.go.dev/vuln/GO-2026-4693

CVE-2026-31886 · published 2026-03-13T15:40:11Z · modified 2026-03-23T04:56:24.375198809Z · JSON