github.com/getarcaneapp/arcane/backend (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/getarcaneapp/arcane/backend, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2026-45625 — CVSS 9.9 (critical): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes…
• CVE-2026-23520 — CVSS 9.0 (critical): Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater…
• CVE-2026-47125 — CVSS 8.8 (high): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templa…
• CVE-2026-45627 — CVSS 8.2 (high): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET…
• CVE-2026-47179 — CVSS 7.7 (high): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent…
• CVE-2026-42461 — CVSS 7.5 (high): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under…
• CVE-2026-40242 — CVSS 7.2 (high): Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint…
• CVE-2026-45626 — CVSS 6.3 (medium): Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/…