Goploy Package Vulnerability Under Investigation
An early warning has been issued regarding a potential vulnerability in the Goploy package, which reportedly allows unauthorized users to access and modify project files and execute remote code.
What happened
The Goploy package, specifically the develop HEAD version as of 2026-05-27, is under investigation for a vulnerability that may allow unauthorized users to read, write, or delete files in any project, as well as rewrite project git remote URLs. This could lead to remote code execution. The vulnerability appears to be related to cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers.
Professional software engineers using the Goploy package should assess their exposure by checking if they are using the affected version. It is recommended to upgrade to a version with the fix or apply a patch if available. For more detailed information, consult the primary sources linked in the threat data.
The severity of this potential vulnerability is high, and it is crucial for affected parties to take immediate action to mitigate any risks. The investigation is ongoing, and further details may become available as the situation develops.
How 0Day mitigates this
zhenorzz/goploy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.