| id: GO-2025-3999 |
| modules: |
| - module: github.com/canonical/lxd |
| non_go_versions: |
| - introduced: 0.0.0-20200331193331-03aab09f5b5c |
| - fixed: 0.0.0-20250827065555-0494f5d47e41 |
| - introduced: 4.0.0 |
| - fixed: 5.21.4 |
| - introduced: 6.0.0 |
| - fixed: 6.5.0 |
| summary: |- |
| Privilege Escalation via WebSocket Connection |
| Hijacking in Operations API in github.com/canonical/lxd |
| cves: |
| - CVE-2025-54289 |
| ghsas: |
| - GHSA-3g72-chj4-2228 |
| references: |
| - advisory: https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228 |
| notes: |
| - Pseudoversions specified in advisory are insufficient to accurately mark go_versions. |
| source: |
| id: GHSA-3g72-chj4-2228 |
| created: 2025-11-03T13:06:46.85112-05:00 |
| review_status: REVIEWED |
