HIGH8.4
GO-2026-6585
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
Quick fix
GO-2026-6585 — github.com/klever-io/klever-go: upgrade to the fixed version with the command below.
go get github.com/klever-io/klever-go@v1.7.20Details
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/klever-io/klever-go
Introduced in:
0Fixed in: 1.7.20Fix
go get github.com/klever-io/klever-go@v1.7.20References
- https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj[ADVISORY]
- https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af[FIX]
- https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190[FIX]
- https://github.com/klever-io/klever-go/releases/tag/v1.7.20[WEB]