CVE-2026-63644

CVSS 7.5 (high) · published 2026-11-09

bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7.

Weakness: CWE-88, CWE-200

Source: NVD CVE-2026-63644

References

• https://github.com/xddxdd/bird-lg-go/commit/74762e4be0d5f19edd710ebfae5b8e8c5bb30e32
• https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.7
• https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-3qm5-22pm-wqg9
• https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-3qm5-22pm-wqg9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.