GO-2026-4320
NoneCVSS
—
EPSS
—
Published
Jan 23, 2026
CISA due date
—
The record
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/getarcaneapp/arcane/backend | 0 | 0.0.0-20260114065515-5a9c2f92e11f |