Go/github.com/patrickhener/goshs/v2: unknown

Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5232#Go/github.com/patrickhener/goshs/v2
• https://github.com/patrickhener/goshs/security/advisories/GHSA-7qx6-f23w-3w7f

published 2026-06-25T18:43:15Z · modified 2026-06-25T19:45:17.533002947Z · JSON