VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gophish/gophish: vulnerability history, versions and safety

github.com/gophish/gophish is a package in the Go ecosystem. Vulert records 14 vulnerabilities for it across 120 releases, from May 2022 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
14 vulnerabilities recorded H3 M5 U6
i
8 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
4 in the last 12 months

Most recent disclosure 18 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gophish/gophish vulnerabilities

Vulert verdict on github.com/gophish/gophish v0.12.1 i

Updated on 23 Oct 2026

Careful: v0.12.1 has 14 known vulnerabilities, and 8 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Some issues to review
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.12.1 — affected i
  • Vulnerabilities on record 14 over 4 years · 4 in the last year i
  • Latest disclosure 18 Aug 2026 i
  • Highest CVSS 7.5 i
  • With no published fix 8 i
  • Stars 14,338 i
  • OpenSSF scorecard 3/10 i
  • Last release 49 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gophish/gophish, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.12.2-0.20240923042443-956184697992 23 Sep 2024 H3 M5 U6 MIT No Details →
v0.0.0-20230915144530-8e7929441393 15 Sep 2023 H3 M5 U6 MIT No Details →
v0.12.2-0.20230915144530-8e7929441393 15 Sep 2023 H3 M5 U6 MIT No Details →
v0.0.0-20221216170455-d2efb18ef1e3 16 Dec 2022 H3 M5 U6 MIT No Details →
v0.12.2-0.20221216170455-d2efb18ef1e3 16 Dec 2022 H3 M5 U6 MIT No Details →
v0.12.2-0.20221013151637-cec2da512890 13 Oct 2022 H3 M5 U6 MIT No Details →
v0.12.2-0.20220929122131-095a9ba20c41 29 Sep 2022 H3 M5 U6 MIT No Details →
v0.12.1 14 Sep 2022 H3 M5 U6 MIT No Details →
v0.12.1-0.20220912210534-a53665b1b6e9 12 Sep 2022 H3 M5 U6 MIT No Details →
v0.12.1-0.20220906142019-78e9a5116845 06 Sep 2022 H3 M5 U6 MIT No Details →
v0.12.1-0.20220826210914-3863ad31b9e3 26 Aug 2022 H3 M5 U6 MIT No Details →
v0.12.1-0.20220825132854-34f745729492 25 Aug 2022 H3 M5 U6 MIT No Details →
v0.12.1-0.20220824160000-32c050299940 24 Aug 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220812193143-6b61426aabc2 12 Aug 2022 H3 M5 U6 MIT No Details →
v0.12.0 12 Aug 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220809142429-90cd444dcb04 09 Aug 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220611102556-5ef2d75e72a0 11 Jun 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220605201832-6fb77bf3ceee 05 Jun 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220601160155-d0ff3829e588 01 Jun 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220601154004-0c255bbe92fd 01 Jun 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220601151422-b7c69662ced6 01 Jun 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220415142819-704e6d56b328 15 Apr 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220325152449-bb516ef7aba4 25 Mar 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220225121019-e0acb99734b2 25 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220217140351-eb016a437cf6 17 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220216162651-67e304f3724e 16 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220216154630-e215132bdfc4 16 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220216153038-741201b7f09a 16 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220207161255-1f95efcb7b0b 07 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20220202144127-a6627dfc6b1d 02 Feb 2022 H3 M5 U6 MIT No Details →
v0.11.1-0.20211223181343-0646f14c9904 23 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084934-ceab0509eba7 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084920-202ecd339741 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084911-4b106b3fe209 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084850-1d18ea7e013d 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084841-b3f0bad5cef0 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084833-12ecfd84cc0c 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20211218084800-4814620cdce2 18 Dec 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210901040010-003d1436418c 01 Sep 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210810234211-f89c85f5585d 10 Aug 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210525073327-5aa3a858cb63 25 May 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210510070801-82fd6adf68b8 10 May 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210508150326-5fc6ba6beff4 08 May 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210429185225-a5b3b134bacc 29 Apr 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210330153951-f72206501801 30 Mar 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210328204031-db63ee978dcd 28 Mar 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210328203841-96d1a5555861 28 Mar 2021 H3 M5 U6 MIT No Details →
v0.10.2-0.20210306201706-51cb65a44e97 06 Mar 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210306174042-54d9eb28ff3c 06 Mar 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210224233438-15303e32cfc9 24 Feb 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210124200140-166ff8a05039 24 Jan 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20210124194410-e6533e9993e4 24 Jan 2021 H3 M5 U6 MIT No Details →
v0.11.1-0.20201211132428-9f5368aa13f4 11 Dec 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201207145605-ced52616787f 07 Dec 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20201120142725-aabf8925adac 20 Nov 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201015013532-8b8e88b07739 15 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201011224937-120e232cfed6 11 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201011221833-23154126de98 11 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201011185942-af3122f93bad 11 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201001030015-3c490dbadbe6 01 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20201001020608-b53cff0c9822 01 Oct 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20200924021519-c1d3c7cd7583 24 Sep 2020 H3 M5 U6 MIT No Details →
v0.11.1-0.20200924014021-0b2ab68f8db4 24 Sep 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200828191320-ad20017981d8 28 Aug 2020 H3 M5 U6 MIT No Details →
v0.11.0 28 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200824181516-b01bd6cbc0bb 24 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200820153923-6df62e85fd60 20 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200820143618-e3352f481e94 20 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200815153149-27d13a058473 15 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200808200459-735880c39830 08 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200808200342-0558da90fe99 08 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200807032141-90fed5a57562 07 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200803020849-81aa65ba62da 03 Aug 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200729013540-da18b9db9449 29 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200725194737-b684fb4ebd37 25 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200725041429-65f06c138f12 25 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200725040455-19ef924d89f6 25 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200725034424-b25f5ac5e468 25 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200718034010-4e9b94b64175 18 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200718032344-cf7d058f1d78 18 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200718031404-1c5ad85de199 18 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200718030917-f2042de3bccd 18 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200702030631-afa00e2a9c82 02 Jul 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200625133128-bf76f86ea4ba 25 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200620030351-bb7de8df3e7d 20 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200617011324-0f6439de5a88 17 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200617011012-61bbb22f7c7e 17 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200617010209-6f95da00ba00 17 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200613184420-8ebdb43469da 13 Jun 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200526024636-ec8b17238ee7 26 May 2020 H3 M5 U6 MIT No Details →
v0.10.2-0.20200526015500-0961e22126e4 26 May 2020 H3 M5 U6 MIT No Details →
v0.10.1 25 May 2020 H3 M5 U6 MIT No Details →
v0.10.1-0.20200525032457-b57210f6e7cb 25 May 2020 H3 M5 U6 MIT No Details →
v0.10.0 25 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200525024940-ba38bfdbdd8e 25 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200523175618-b29544c20885 23 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200523175143-353639e1680f 23 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200509020205-726e3c96ac77 09 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200509020022-40b77840f5c7 09 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200504030358-116c2a7e7e48 04 May 2020 H3 M5 U6 MIT No Details →
v0.9.1-0.20200427231920-38a6a77c9c1e 27 Apr 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200427035139-26e82cb2e3dd 27 Apr 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200424041644-a0e8c4a36936 24 Apr 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200328032518-07b46d226aa0 28 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200328022941-138b486b2f87 28 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200322175552-c5c1e6ff685e 22 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200315174119-118d9899d655 15 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200315173851-c0be58aa3dfb 15 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200315173349-053b998b8482 15 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200305133119-6251ea6a0283 05 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200305132817-2e3aacd22d4a 05 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200301021954-8162a80cb1c2 01 Mar 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200212054848-6e20f6432248 12 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200203034425-1733da1fa8f2 03 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200202041134-26884a8f3495 02 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200202035924-4375e5f6a1f4 02 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200202034450-be459e47bf23 02 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200202033642-e12258bf25bd 02 Feb 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200130130904-3d525525ea4f 30 Jan 2020 H3 M5 U6 — No Details →
v0.9.1-0.20200126040943-0620671de602 26 Jan 2020 H3 M5 U6 — No Details →

The newest 120 of 815 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 3
  • 2023 2
  • 2024 4
  • 2025 1
  • 2026 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 4 of the 14 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gophish/gophish

The 5 most severe of 14 vulnerabilities recorded for this package

Search all 14 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Cleartext Password Exposure in GoPhish - High Severity Vulnerability 7.5 high No fix published 19 Dec 2024
CVE-2022-45003: Gophish Denial of Service via Crafted Payload 7.5 high No fix published 22 Mar 2023
CVE-2026-39904: Gophish Denial of Service Vulnerability Due to Unrestricted Office Document Uploads 6.5 high No fix published 22 Jun 2026
CVE-2022-45004: Gophish XSS Vulnerability 6.1 medium No fix published 22 Mar 2023
CVE-2025-70963: Gophish API Key Exposure Due to Incorrect Access Control 6.0 medium No fix published 06 Feb 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gophish/gophish

Is github.com/gophish/gophish safe to use?

Vulert records 14 vulnerabilities for github.com/gophish/gophish in Go: 0 critical, 3 high, 5 medium and 0 low, plus 6 not yet rated. 8 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/gophish/gophish's Vulert package health score?

Vulert scores github.com/gophish/gophish 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/gophish/gophish affected?

Yes. v0.12.1, the version you would install today, has 14 known vulnerabilities, and 8 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/gophish/gophish should I use?

v0.12.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/gophish/gophish have?

14 vulnerabilities are recorded for github.com/gophish/gophish in the Go ecosystem: 0 critical, 3 high, 5 medium and 0 low, plus 6 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gophish/gophish vulnerabilities disclosed?

4 vulnerabilities were recorded for github.com/gophish/gophish in the last 12 months, and the oldest entry in this database dates to 24 May 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gophish/gophish are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gophish/gophish for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gophish/gophish version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.