VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/kopia/kopia: vulnerability history, versions and safety

github.com/kopia/kopia is a package in the Go ecosystem. Vulert records 4 vulnerabilities for it across 120 releases, from Apr 2024 to May 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded C1 L1 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 20 May 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/kopia/kopia vulnerabilities

Vulert verdict on github.com/kopia/kopia v0.23.1 i

Updated on 23 Oct 2026

Action needed: v0.23.1 has 4 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 80/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.23.1 — affected i
  • Vulnerabilities on record 4 over 2 years · 2 in the last year i
  • Latest disclosure 20 May 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 0 i
  • Stars 14,359 i
  • OpenSSF scorecard 5/10 i
  • Last release 4 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/kopia/kopia, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261020033011-083500573702 20 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261020033011-083500573702 20 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261020013319-70243845f5fc 20 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261020013319-70243845f5fc 20 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261019233854-59b8dfe203b9 19 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261019233854-59b8dfe203b9 19 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261016032556-01938f966dc3 16 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261016032556-01938f966dc3 16 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261015160540-76e4e8eadf97 15 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261015160540-76e4e8eadf97 15 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261014221659-ef380ffd094a 14 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261014221659-ef380ffd094a 14 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261014162948-e8c18a83f01e 14 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261014031223-bc517ac0d24f 14 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261014031223-bc517ac0d24f 14 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261013193142-69fa1b2fae5e 13 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261013013638-56ff29106270 13 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261012185215-263c792ba78e 12 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261012185215-263c792ba78e 12 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261009174924-d3bc691b2109 09 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261009174924-d3bc691b2109 09 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261009021004-e139aa8870a8 09 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261005232010-8ba5f53a1c70 05 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261005232010-8ba5f53a1c70 05 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261003051009-b1da59999d50 03 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261003051009-b1da59999d50 03 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261003002206-9b3243ead4f4 03 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261003002206-9b3243ead4f4 03 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261001064544-9cf5084fbf24 01 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261001064544-9cf5084fbf24 01 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261001035905-111a6842fb98 01 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20261001033808-155ed0f852de 01 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20261001033808-155ed0f852de 01 Oct 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260929032751-87d15ded6205 29 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260929032751-87d15ded6205 29 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260928173741-5e0fcc535e15 28 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260928173741-5e0fcc535e15 28 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260927053511-aa02841ac388 27 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260927053511-aa02841ac388 27 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260925053553-1d4d45a27486 25 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260925053553-1d4d45a27486 25 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260925034408-661ba6e9c329 25 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260925034408-661ba6e9c329 25 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260917044138-0295aac97fe7 17 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260917044138-0295aac97fe7 17 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260915234708-9b964a7993d0 15 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260915234708-9b964a7993d0 15 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260914050518-cf835b29eee1 14 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260914050518-cf835b29eee1 14 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260910224706-e8daf1138b83 10 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260910224706-e8daf1138b83 10 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260909040929-7659f849a119 09 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260909040929-7659f849a119 09 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260908031923-848085632d76 08 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260908031923-848085632d76 08 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260907054833-82495e54b584 07 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260907054833-82495e54b584 07 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260905214844-dbc4b460529f 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260905214844-dbc4b460529f 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260905200108-6d8670bdb03f 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260905200108-6d8670bdb03f 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260905193506-b32b2e077229 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260905193506-b32b2e077229 05 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260903200116-4ceee29c7d6b 03 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260903200116-4ceee29c7d6b 03 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260903055631-7de9f36a732f 03 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260903025307-bfe4ecf686a7 03 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260902050721-959644ca2806 02 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260902050721-959644ca2806 02 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260902040437-48a144be1a2c 02 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260902002407-41e2bc42cd0d 02 Sep 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260831223846-f837e011acb0 31 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260825003623-a4602657a2bf 25 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260825003623-a4602657a2bf 25 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260821214603-4ebb2be6c503 21 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260821214603-4ebb2be6c503 21 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260818034419-5f9fe81ec47c 18 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260818034419-5f9fe81ec47c 18 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260818002445-e73a5a03c331 18 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260818000323-b0138a6e40af 18 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260818000323-b0138a6e40af 18 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260815210931-b6bd7224841f 15 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260815210931-b6bd7224841f 15 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260814004621-b0b839fee33c 14 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260814004621-b0b839fee33c 14 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260812060821-a058e94302c1 12 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260812060821-a058e94302c1 12 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260806054031-b361d0f41008 06 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260806054031-b361d0f41008 06 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260805003024-71a860874aee 05 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260805003024-71a860874aee 05 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260804024001-0888691afcf7 04 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260804024001-0888691afcf7 04 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260801044040-133fc64cf158 01 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260801044040-133fc64cf158 01 Aug 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260730051234-444d41a38600 30 Jul 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260730051234-444d41a38600 30 Jul 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260729045238-fbbaf027f2b2 29 Jul 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260729045238-fbbaf027f2b2 29 Jul 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.0.0-20260725045556-d7ba2130918f 25 Jul 2026 C1 L1 U2 Apache-2.0 Yes Details →
v0.23.2-0.20260725045556-d7ba2130918f 25 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260722182133-40f45b06dcb7 22 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260722182133-40f45b06dcb7 22 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260722062905-c21ae5c4b722 22 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260722062905-c21ae5c4b722 22 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260717180742-0c1568729b6a 17 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260717180742-0c1568729b6a 17 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260716061950-674a5abd6d89 16 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260716061950-674a5abd6d89 16 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260715062058-81272450a8f2 15 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260715062058-81272450a8f2 15 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260711052659-7d70c3fea68c 11 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260711052659-7d70c3fea68c 11 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260709164935-3877e3714b93 09 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260709164935-3877e3714b93 09 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260709025658-6c65de117629 09 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260709025658-6c65de117629 09 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260708050503-82be73eda3ea 08 Jul 2026 C1 L1 U2 — Yes Details →
v0.0.0-20260708040649-c1e63ceb240a 08 Jul 2026 C1 L1 U2 — Yes Details →
v0.23.2-0.20260708040649-c1e63ceb240a 08 Jul 2026 C1 L1 U2 — Yes Details →

The newest 120 of 1,130 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 2
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/kopia/kopia

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-45695: Kopia RCE via SSH ProxyCommand Injection Vulnerability 9.8 critical 0.23.0 19 May 2026
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output 2.0 low 0.16.0 10 Apr 2024
Credentials Leakage in Kopia Storage Connection N/A unrated 0.16.0 04 Jun 2024
CVE-2026-45695: Remote Code Execution via SSH ProxyCommand Injection in Kopia N/A unrated 0.23.0 20 May 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/kopia/kopia

Is github.com/kopia/kopia safe to use?

Vulert records 4 vulnerabilities for github.com/kopia/kopia in Go: 1 critical, 0 high, 0 medium and 1 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/kopia/kopia's Vulert package health score?

Vulert scores github.com/kopia/kopia 80/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/kopia/kopia affected?

Yes. v0.23.1, the version you would install today, has 4 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/kopia/kopia should I use?

v0.23.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/kopia/kopia have?

4 vulnerabilities are recorded for github.com/kopia/kopia in the Go ecosystem: 1 critical, 0 high, 0 medium and 1 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/kopia/kopia vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/kopia/kopia in the last 12 months, and the oldest entry in this database dates to 10 Apr 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/kopia/kopia are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/kopia/kopia for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/kopia/kopia version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.