GHSA-rwj2-w85g-5cmm goshs route not protected, allows command execution

• Go github.com/patrickhener/goshs: >= 0.3.4, < 1.0.5 → fixed in 1.0.5

Summary It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4. Details It seems that the function ```dispatchReadPump``` does not checks the option cli ```-c```, thus allowing anyone to execute arbitrary command through the use of websockets. PoC Used websocat for the POC: ```bash echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t ``` Impact The vulnerability will only impacts goshs server on vulnerable versions.