GHSA-XX6G-43W2-9G6G

OliveTin's email argument makes compliance harder, enables log injection

• End users whose email addresses are stored in ERROR logs without consent GDPR/CCPA violation risk for operators
• Security operations teams whose SIEM/log aggregation systems can be fed forged events by any user who can submit email-type action arguments
• On-call engineers subjected to continuous false positive ERROR alerts from valid form submissions
• Operators who use type: email for informal token/API key validation those secrets appear in ERROR logs

Kodem intelligence

Already deployed Kodem?

func typeSafetyCheckEmail(value string) error {
    _, err := mail.ParseAddress(value)
    if err != nil {
        log.WithField("type", "email").Debugf("Email argument type check failed")
        return err
    }
    return nil
}

Only log on failure, at DEBUG level, and never log the value itself.

1. What is GHSA-XX6G-43W2-9G6G? GHSA-XX6G-43W2-9G6G is a medium-severity security vulnerability in github.com/OliveTin/OliveTin (go), affecting versions < 3000.11.3. It is fixed in 3000.11.3.
2. Which versions of github.com/OliveTin/OliveTin are affected by GHSA-XX6G-43W2-9G6G? github.com/OliveTin/OliveTin (go) versions < 3000.11.3 is affected.
3. Is there a fix for GHSA-XX6G-43W2-9G6G? Yes. GHSA-XX6G-43W2-9G6G is fixed in 3000.11.3. Upgrade to this version or later.
4. Is GHSA-XX6G-43W2-9G6G exploitable, and should I be worried? Whether GHSA-XX6G-43W2-9G6G is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-XX6G-43W2-9G6G is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-XX6G-43W2-9G6G? Upgrade github.com/OliveTin/OliveTin to 3000.11.3 or later.

Other vulnerabilities in github.com/OliveTin/OliveTin