
A curated list of awesome Go frameworks, libraries and software
A curated list of awesome Go frameworks, libraries and software
We use the _Golang Bridge_ community Slack for instant communication, follow the form here to join.
Add a Back to top button
avelino/awesome-go project page JSON-LD codeRepository field omits JSON escaping, letting contributor-controlled URLs close the script element and inject arbitrary script (CWE-79)
Kong library possibly mis-categorized
Add dqex to the database tools list (offline-first, single-binary DB workbench in Go)
avelino/awesome-go site generator does not validate entry link URI schemes, letting javascript: links into category page href attributes that execute arbitrary script on a single click (CWE-79)
avelino/awesome-go site generator enables goldmark html.WithUnsafe and injects raw README HTML into the production homepage as template.HTML, causing stored XSS (CWE-79)
avelino/awesome-go site generator renders contributor-controlled entry text and repository topics through text/template without HTML escaping, causing stored XSS on the production site (CWE-79)
awesome-go.com pins github.com/yuin/goldmark v1.6.0: IsDangerousURL entity-encoded scheme bypass lands javascript: links in the generated site (CVE-2026-5160 / GHSA-c97m-vxhj-p7j6 / GO-2026-5320)
awesome-go.com pins golang.org/x/net v0.38.0: duplicate-attribute parse/render anomaly tree defeats the "Sanitize HTML" goquery roundtrip (CVE-2026-27136 / GO-2026-5030)
awesome-go.com build trusts a committable .cache/repos metadata cache and renders its fields unescaped: stored XSS via cache poisoning (CWE-79)