VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/jumpserver/koko: vulnerability history, versions and safety

github.com/jumpserver/koko is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 120 releases, from Oct 2023 to Jun 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded M1 U1
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/jumpserver/koko vulnerabilities

Vulert verdict on github.com/jumpserver/koko v0.0.0-20261022061532-8f70dd3e2184 i

Updated on 23 Oct 2026

Careful: v0.0.0-20261022061532-8f70dd3e2184 has 1 known vulnerability, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Widely used
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.0.0-20261022061532-8f70dd3e2184 — affected i
  • Vulnerabilities on record 2 over 1 year · 0 in the last year i
  • Latest disclosure 12 Jun 2025 i
  • Highest CVSS 6.4 i
  • With no published fix 1 i
  • Stars 538 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence GPL-3.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/jumpserver/koko, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022061532-8f70dd3e2184 22 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261020090358-12b668d757c5 20 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261019064442-fb1ea1aa8df9 19 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261016102827-5a2b318bf732 16 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261015101218-065445d278d9 15 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261015085330-d4bc7e4ef383 15 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261015060023-2f4db9eff114 15 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261015050107-720276440c53 15 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261014073443-1969e6ffb911 14 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261014065117-e58a7689ba05 14 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261013101057-95a348e707f7 13 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261013023951-3b93e88b7b0b 13 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261013014310-c8afed34bf57 13 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261012143202-62e0d8e9aa99 12 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261012082231-27235a0ca568 12 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261010095323-f19dc6f65616 10 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261010082305-3c39afc2b2f1 10 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261010073016-f85669d35d91 10 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261010020634-d52a1b582400 10 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261009093441-1ad4be7453d6 09 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261009025352-8af4ed70ae75 09 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20261008034718-c78127974e1d 08 Oct 2026 U1 GPL-3.0 No Details →
v0.0.0-20260929095238-48c71da7a6bb 29 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260929065215-ef9bc475aa81 29 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260924082110-9651baa4bc4b 24 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260924035520-be4e3a86cac2 24 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260923113352-b6d892577602 23 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260923101452-042c42bc5d39 23 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260923084928-541f3d48be4e 23 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260923081017-5163a44535c2 23 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260922022648-e82f97d3421c 22 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260921123343-e3445777f988 21 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260921100244-54d9be55650e 21 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260921065324-da50269a1553 21 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260921062033-378ab677b2f9 21 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260921060516-d9a84f2ffa12 21 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260920033427-3d7281f0469e 20 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260918094705-4e539460bee9 18 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260918041205-64318ddfe1f7 18 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260918033259-59894cb10798 18 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260918030651-6e0b11efde18 18 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260917084100-a4d7740d7dc0 17 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260917064553-3a952dc7c45f 17 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260917034752-40d58c578429 17 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260917034320-2bfd327b6b6f 17 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260917021401-c99e382ac74f 17 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916150016-0fb9226ad7b0 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916102507-123af5879bc7 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916090239-f5c020a9bfd2 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916071120-36a1b41b7ce6 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916044354-a332cc375f51 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260916043001-a9854c0585b6 16 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915104348-eede11804f11 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915095337-47f87ba75b92 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915092257-58393d982448 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915090730-ad1367c5e6b9 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915082111-1731bee4d201 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915050500-b1e07121c84c 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915034254-59823257f024 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260915023925-3adf88fe3044 15 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914160420-4874fcafc1c6 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914104548-4314c4397842 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914100206-d07bef2fcfe0 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914085846-02e91b0ed565 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914055905-e2efc235cbad 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914050536-47c1a283f059 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914042241-1118e25a6bdc 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260914030458-bd7faf82ed1b 14 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260912001952-cb06f265992d 12 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260911045133-e1810a5107ee 11 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260911034958-5c0534470a15 11 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260910165735-ec5e2cc51321 10 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260910090911-0102d6f2cd76 10 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260910051924-94184aa59e96 10 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260909092852-1d7e8f46e867 09 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260909082426-226eb23ab0bd 09 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260909015151-4cebc93cefd6 09 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260908074607-8d7f535c1863 08 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260907084807-287c566b5222 07 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260905155227-2b6873d7c63b 05 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260905050043-2bdb4b2c6ec0 05 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260904150606-a7b227bf9aa8 04 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260904104548-ab6a42547621 04 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260904102819-3a33a31629c4 04 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260902085830-1001462ec70d 02 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260902074225-c24af14b289d 02 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260902072541-c9f101577cd4 02 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260902031142-5deacb37f325 02 Sep 2026 U1 GPL-3.0 No Details →
v0.0.0-20260831075601-ad0394799df7 31 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260828084022-3bac6d891b0d 28 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260828031343-9f2cc06b3dc9 28 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260828025634-0c210c61274c 28 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826110031-a86d8a2507f0 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826094656-9648d2082332 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826065232-dc0d9a862cf3 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826061118-f5e5dd543df2 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826052406-63c054190c9b 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260826032827-4c6bf5ab1b51 26 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260823035833-8d33904c1b88 23 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260821102435-a6d6f7ad640e 21 Aug 2026 U1 GPL-3.0 No Details →
v0.0.0-20260820083815-1a6befc9c75d 20 Aug 2026 U1 — No Details →
v0.0.0-20260820050549-8bd8820a2560 20 Aug 2026 U1 — No Details →
v0.0.0-20260819104652-43690faf74b0 19 Aug 2026 U1 — No Details →
v0.0.0-20260819034844-95a35b12a1aa 19 Aug 2026 U1 — No Details →
v0.0.0-20260819014006-465c53f4bce2 19 Aug 2026 U1 — No Details →
v0.0.0-20260818093626-fe8a8f1b62f5 18 Aug 2026 U1 — No Details →
v0.0.0-20260818080429-32b846d19659 18 Aug 2026 U1 — No Details →
v0.0.0-20260817064026-a8404be78388 17 Aug 2026 U1 — No Details →
v0.0.0-20260817031628-ac001022f2e5 17 Aug 2026 U1 — No Details →
v0.0.0-20260813143402-08a25719d732 13 Aug 2026 U1 — No Details →
v0.0.0-20260810061123-d88b5f04e7ae 10 Aug 2026 U1 — No Details →
v0.0.0-20260810025611-87c43c72b2ea 10 Aug 2026 U1 — No Details →
v0.0.0-20260810021602-4db0bac0bad6 10 Aug 2026 U1 — No Details →
v0.0.0-20260809150354-86202998fa34 09 Aug 2026 U1 — No Details →
v0.0.0-20260807154950-6ec507b6d4fa 07 Aug 2026 U1 — No Details →
v0.0.0-20260805234237-13889eac530c 05 Aug 2026 U1 — No Details →
v0.0.0-20260804081340-e3dca33b6cff 04 Aug 2026 U1 — No Details →
v0.0.0-20260729032857-0d4e3652c379 29 Jul 2026 U1 — No Details →
v0.0.0-20260728023034-8db3b73c3945 28 Jul 2026 U1 — No Details →
v0.0.0-20260727100126-dfa4e88b93cf 27 Jul 2026 U1 — No Details →

The newest 120 of 976 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1
  • 2025 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/jumpserver/koko

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Jumpserver Koko MongoDB Remote Code Execution Vulnerability (CVE-2023-43651) 6.4 medium 2.28.20 24 Oct 2023
CVE-2023-42818: SSH Public Key Login Vulnerability in Jumpserver Packages N/A unrated No fix published 12 Jun 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/jumpserver/koko

Is github.com/jumpserver/koko safe to use?

Vulert records 2 vulnerabilities for github.com/jumpserver/koko in Go: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/jumpserver/koko's Vulert package health score?

Vulert scores github.com/jumpserver/koko 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/jumpserver/koko affected?

Yes. v0.0.0-20261022061532-8f70dd3e2184, the version you would install today, has 1 known vulnerability, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/jumpserver/koko have?

2 vulnerabilities are recorded for github.com/jumpserver/koko in the Go ecosystem: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/jumpserver/koko vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/jumpserver/koko in the last 12 months, and the oldest entry in this database dates to 24 Oct 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/jumpserver/koko are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/jumpserver/koko for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/jumpserver/koko version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.