Vulnerability in sea-team GoFound

[ Description ]Official description

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go
• github.com/sea-team/gofound/blob/v1.4.1/web/admin/assets/web/src/views/dashboard.vue
• github.com/sea-team/gofound/issues/101
• vul.yulun.ac.cn/20261102/gofound
• www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-searc…