GHSA-86vc-mg26-fj6x

Suggest an improvement
Source
https://github.com/advisories/GHSA-86vc-mg26-fj6x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-86vc-mg26-fj6x
Aliases
Published
2026-03-25T18:31:48Z
Modified
2026-06-25T19:56:39Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds
Details

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595

Database specific 
{
    "cwe_ids": [
        "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T22:21:55Z",
    "nvd_published_at": "2026-03-25T17:16:30Z",
    "severity": "MODERATE"
}
References

Affected packages

Go
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
11.4.0-rc1
Fixed
11.4.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
11.3.0-rc1
Fixed
11.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
11.2.0-rc1
Fixed
11.2.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0-20260105080200-d27a2195068d
Fixed
8.0.0-20260217110922-b7d4a1f1f59b

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
10.11.0-rc1
Fixed
10.11.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-86vc-mg26-fj6x/GHSA-86vc-mg26-fj6x.json"