Vulnerability · Published Aug 18, 2025 · Assigned by GitHub_M
CVE-2025-55300Komari Allows Cross-site WebSocket Hijacking
High 8.6
In plain English
A high-severity cross-site scripting in komari from komari-monitor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users. Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/komari-monitor/komari | 0.0.0-20250809073044-53171affcaf0 | GHSA-q355-h244-969h |
| Go | github.com/komari-monitor/komari | 0.0.0-20250809073044-53171affcaf0 | GO-2025-3874 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| komari-monitor | komari | < 1.0.4-fix1 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N