Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
cleanstart/loki may let attackers tamper with encrypted data
published 23 days ago
Summary
The Go JOSE library used by cleanstart/loki has a flaw that could allow a malicious user to alter or read information that should be protected by encryption or digital signatures. This puts the confidentiality and integrity of data processed by the application at risk. Update to the latest version of the library or apply the vendor's recommended patch as soon as possible.
What to do
- Update cleanstart loki to version 3.7.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r0 Fix: upgrade to 3.7.1-r0
|
Original advisory text
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
Security vulnerability affects the loki package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-NH53620 · OSV
Track software like this
Free during beta