{"id":"GO-2026-5054","revision":"9f13f72b8e8b4bdeaec5cf89da8d842a","records":[{"revision":"9f13f72b8e8b4bdeaec5cf89da8d842a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5054","aliases":["CVE-2026-48113","GHSA-24fp-5v3p-rvpw"],"title":"Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel","description":"Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel","state":0,"publishedAt":"2026-06-16T23:55:18+00:00","modifiedAt":"2026-06-17T00:15:12.8868599+00:00","affected":[{"ecosystem":"Go","name":"github.com/jpillora/chisel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.11.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/jpillora/chisel/security/advisories/GHSA-24fp-5v3p-rvpw"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5054","license":"OSV · upstream source license applies","key":"osv:GO-2026-5054","identifiers":["GO-2026-5054","CVE-2026-48113","GHSA-24fp-5v3p-rvpw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}