GHSA-84vh-m24q-wjjx: Go/github.com/pocketbase/pocketbase vulnerability
PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process.
To prevent this from hapenning all existing internal worker functions were wrapped with the new helper routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).
The vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase v0.39.7 (the fix was also backported in v0.22.48 in case you are using older PocketBase < v0.23.0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/pocketbase/pocketbaseto a version that resolves this vulnerability.Fixed in 0.39.7 - Upgrade
Upgrade
go/github.com/pocketbase/pocketbaseto a version that resolves this vulnerability.Fixed in 0.22.48 - Upgrade
Upgrade
pocketbase/pocketbaseto a version that resolves this vulnerability.Fixed in v0.39.7 - Upgrade
Upgrade
pocketbase/pocketbaseto a version that resolves this vulnerability.Fixed in v0.22.48 - Configuration
Update PocketBase so all existing internal worker functions are wrapped with the helper `routine.SafeWrap(f)`.
PocketBase internal worker goroutines routine.SafeWrap(f) = wrap internal worker functions with routine.SafeWrap(f) to auto-recover panics and return them as errors
Event History
Frequently Asked Questions
Are deployments protected by the existing panic-recovery middleware?
No. The built-in middleware recovers panics during regular request handling, but it does not cover panics in internal child or worker goroutines. Such a panic can terminate the server process.
What versions should be deployed to remediate this issue?
Upgrade to PocketBase v0.39.7. For deployments using PocketBase versions earlier than v0.23.0, the fix was backported in v0.22.48.
What is the operational impact if a vulnerable instance encounters this condition?
An unhandled panic in an internal child or worker goroutine may terminate the PocketBase server process. This can result in service interruption until the process is restarted.