Insecure Variable Substitution in github.com/go-vela/types
Summary
GO-2024-2649: Types for Vela Insecure Variable Substitution in github.com/go-vela/types. Affects github.com/go-vela/types versions < 0.23.2. Fixed in 0.23.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/go-vela/types is a Go package that provides types and structures for Vela, a continuous integration and deployment platform. It is used to define and manage variables for Vela pipelines. The package is an essential component of Vela and is widely used in various projects.
Vulnerability Detail
The vulnerability in github.com/go-vela/types is related to insecure variable substitution. This vulnerability allows an attacker to inject malicious code or access sensitive information by manipulating the variable substitution process. It can lead to unauthorized access, data leakage, or remote code execution depending on the context in which the package is used. The vulnerability affects versions prior to 0.23.2 of the package.
How To Fix
Latest published version: v0.26.1 as of 23 Oct 2026
go get github.com/go-vela/types@v0.26.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.2
This is the first release that contains the fix.
go get github.com/go-vela/types@v0.23.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
Insecure Variable Substitution in github.com/go-vela/types is a critical vulnerability that can lead to unauthorized access, data leakage, or remote code execution. It is recommended to upgrade to version 0.23.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-vela/types →
FAQ
This vulnerability allows an attacker to manipulate variable substitution and potentially execute arbitrary code or access sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
No, only versions prior to 0.23.2 are affected. It is recommended to upgrade to the latest secure version.
There are no known public exploits for this vulnerability at the moment. However, it is important to fix it as soon as possible to prevent any potential attacks.
You can find more information about this vulnerability in the vulnerability details page at https://pkg.go.dev/vuln/GO-2024-2649.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-vela/types.
