CVE-2023-26131

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found.

• CWE-79
• CWE-79
• CWE-79

• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L512Broken Link
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L514Broken Link
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/themes/html.go%23L145Broken Link
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112Exploit, Third Party Advisory
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L512Broken Link
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L514Broken Link
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/themes/html.go%23L145Broken Link
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112Exploit, Third Party Advisory

Published

May 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26125Versions of the package github.com/gin-gonic/gin before 1.9.…7.3
• CVE-2023-26126All versions of the package m.static are vulnerable to Direc…5.3
• CVE-2023-26127All versions of the package n158 are vulnerable to Command I…7.8
• CVE-2023-26128All versions of the package keep-module-latest are vulnerabl…7.8
• CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command…7.8
• CVE-2023-26130Versions of the package yhirose/cpp-httplib before 0.12.4 ar…8.8
• CVE-2023-26132Versions of the package dottie before 2.0.4 are vulnerable t…7.5
• CVE-2023-26133All versions of the package progressbar.js are vulnerable to…9.8
• CVE-2023-26134Versions of the package git-commit-info before 2.0.2 are vul…9.8
• CVE-2023-26135All versions of the package flatnest are vulnerable to Proto…9.8
• CVE-2023-26136Versions of the package tough-cookie before 4.1.3 are vulner…9.8
• CVE-2023-26137All versions of the package drogonframework/drogon are vulne…6.1