HIGHGo
GHSA-6m68-r693-78qx· CVE-2026-55883, GO-2026-5181Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
Modified: 7/21/2026
package
Go/github.com/tilt-dev/tilt
pkg:go/github.com/tilt-dev/tilt
CRITICALGo
GHSA-c73q-8xxr-rgqm· CVE-2026-55884, GO-2026-5317Tilt: Missing authentication on the network-exposed Tilt HUD server
Modified: 6/25/2026
HIGHGo
GHSA-p749-9w62-w533· CVE-2026-55882, GO-2026-5533Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
Modified: 6/25/2026
—Go
GO-2026-5181· CVE-2026-55883, GHSA-6m68-r693-78qxTilt: Cross-site WebSocket hijacking of the Tilt HUD stream in github.com/tilt-dev/tilt
Modified: 6/25/2026
—Go
GO-2026-5317· CVE-2026-55884, GHSA-c73q-8xxr-rgqmTilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt
Modified: 6/25/2026
—Go
GO-2026-5533· CVE-2026-55882, GHSA-p749-9w62-w533Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server in github.com/tilt-dev/tilt
Modified: 6/25/2026