GitHub Advisoryadvisory · Go

GHSA-pqhx-w72w-m393 ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

CRITICAL Published 2026-04-23 Modified 2026-05-08 Official page ↗

Aliases: CVE-2026-39087
Ecosystem: Go
Packages: heckel.io/ntfy/v2
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-94
Reviewed: 2026-05-08

Affected packages

• Go heckel.io/ntfy/v2: < 2.22.0 → fixed in 2.22.0

Description

An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.

Related

Alias · CVE (1)

CVE-2026-39087 ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs. vulnerability

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References