« Volver al listado

CVE-2026-24489

Estado: AplazadaMedia (5.3)—

Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\r\n` (CRLF), `\n` (LF), or `\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\r`, `\n`, and `\x00` characters from both header names and values before they are included in HTTP requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gakido — GakidoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24489",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24489",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-27T14:46:28.507941Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "HappyHackingSpace",
          "product": "gakido",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-27T01:16:02.453",
  "references": [
    {
      "url": "https://github.com/HappyHackingSpace/gakido/commit/369c67e67c63da510c8a9ab021e54a92ccf1f788",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HappyHackingSpace/gakido/releases/tag/v0.1.1-1bc6019",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HappyHackingSpace/gakido/security/advisories/GHSA-gcgx-chcp-hxp9",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        },
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\\r\\n` (CRLF), `\\n` (LF), or `\\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\\r`, `\\n`, and `\\x00` characters from both header names and values before they are included in HTTP requests."
    },
    {
      "lang": "es",
      "value": "Gakido es un cliente HTTP de Python centrado en la suplantación de navegadores y la evasión de bots. Se descubrió una vulnerabilidad en Gakido anterior a la versión 0.1.1 que permitía la inyección de encabezados HTTP a través de secuencias CRLF (retorno de carro y salto de línea) en los valores y nombres de los encabezados proporcionados por el usuario. Al realizar solicitudes HTTP con valores de encabezado controlados por el usuario que contienen caracteres `\\r\\n` (CRLF), `\\n` (LF) o `\\x00` (byte nulo), un atacante podía inyectar encabezados HTTP arbitrarios en la solicitud. La corrección en la versión 0.1.1 añade una función `_sanitize_header()` que elimina los caracteres `\\r`, `\\n` y `\\x00` tanto de los nombres como de los valores de los encabezados antes de que se incluyan en las solicitudes HTTP."
    }
  ],
  "lastModified": "2026-06-17T10:23:08.793",
  "sourceIdentifier": "security-advisories@github.com"
}