Read the docs
TI-2020-16104 Aliases CVE-2020-26283GHSA-r4gv-vj59-cccm

Control character injection in console output

Priority MEDIUM 41CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.

Why it matters now

EPSS 0.01501 74th percentileScored 2026-11-07
Fix Fixed go-ipfs (ipfs): 0.8.0github.com/ipfs/go-ipfs (Go): 0.8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ipfsgo-ipfsbefore 0.8.00.8.0Patch availableCNA
—github.com/ipfs/go-ipfs (Go)before 0.8.00.8.0Patch availableGHSA-r4gv-vj59-cccm
  • go-ipfs Vendoripfs Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA
  • github.com/ipfs/go-ipfs (Go) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-r4gv-vj59-cccm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:protocol:go-ipfs:*:*:*:*:*:*:*:*before 0.8.0VulnerableProtocol
  • cpe:2.3:a:protocol:go-ipfs:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·Protocol

Remediation

  • Fix · CNA go-ipfs (ipfs) Fixed in 0.8.0
  • Fix · GHSA-r4gv-vj59-cccm github.com/ipfs/go-ipfs (Go) Fixed in 0.8.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26283
  2. 2026-10-03 Alias added: GHSA-r4gv-vj59-cccm

References

Patch 2

Advisory 2

  • TI-2023-09455 Denial of service when feeding malformed size arguments in go-bitfield CVSS 3.1HIGH 7.5
  • TI-2023-10871 Boxo bitswap/server: DOS unbounded persistent memory leak CVSS 3.1HIGH 8.2
  • TI-2020-08933 Exposure of Sensitive Information to an Unauthorized Actor in AEgir CVSS 3.1CRITICAL 9.6
  • TI-2022-07554 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag CVSS 3.1HIGH 7.5
  • TI-2020-16100 Path traversal in ipfs go-ipfs CVSS 3.1HIGH 8.1
  • TI-2016-08604 Cryptographic flaw in HackerOne go-ipfs-dep node module CVSS 3.0HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences