A ready-made attack for a flaw in dagu-org dagu is now public
KROMSE explanation
dagu-org dagu has a security flaw (CVE-2026-33344, CVSS 8.1). The official record says: Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running dagu-org dagu.
- Install the maker's update for dagu-org dagu as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
