GO-2026-6489
- Source
- https://pkg.go.dev/vuln/GO-2026-6489
- Import Source
- https://vuln.go.dev/ID/GO-2026-6489.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6489
- Aliases
- Published
- 2026-10-07T14:10:35Z
- Modified
- 2026-10-07T17:45:12Z
- Summary
- Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase
- Details
-
Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6489" }- References
-
- https://github.com/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx
- https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220
- https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95
- https://github.com/pocketbase/pocketbase/discussions/7762
- https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48
- https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7
Affected packages
Go / github.com/pocketbase/pocketbase
Package
- Name
- github.com/pocketbase/pocketbase
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/pocketbase/pocketbase
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.22.48Introduced0.23.0Fixed0.39.7
Ecosystem specific
{
"imports": [
{
"path": "github.com/pocketbase/pocketbase/tools/cron",
"symbols": [
"Cron.SetInterval",
"Cron.Start"
]
},
{
"path": "github.com/pocketbase/pocketbase/tools/search",
"symbols": [
"Provider.Exec",
"Provider.ParseAndExec"
]
},
{
"path": "github.com/pocketbase/pocketbase/plugins/jsvm",
"symbols": [
"BindApis",
"BindCore",
"BindDbx",
"BindFilepath",
"BindFilesystem",
"BindForms",
"BindHTTP",
"BindMails",
"BindOS",
"BindSecurity",
"MustRegister",
"Register",
"plugin.watchHooks"
]
},
{
"path": "github.com/pocketbase/pocketbase/core",
"symbols": [
"AuthAlertConfig.Validate",
"AuthOrigin.CollectionRef",
"AuthOrigin.Created",
"AuthOrigin.Fingerprint",
"AuthOrigin.RecordRef",
"AuthOrigin.SetCollectionRef",
"AuthOrigin.SetFingerprint",
"AuthOrigin.SetRecordRef",
"AuthOrigin.Updated",
"AutodateField.Intercept",
"AutodateField.PrepareValue",
"AutodateField.ValidateSettings",
"BackupsConfig.Validate",
"BaseApp.AuxDelete",
"BaseApp.AuxDeleteWithContext",
"BaseApp.AuxHasTable",
"BaseApp.AuxRunInTransaction",
"BaseApp.AuxSave",
"BaseApp.AuxSaveNoValidate",
"BaseApp.AuxSaveNoValidateWithContext",
"BaseApp.AuxSaveWithContext",
"BaseApp.AuxVacuum",
"BaseApp.Bootstrap",
"BaseApp.CanAccessRecord",
"BaseApp.CountRecords",
"BaseApp.CreateBackup",
"BaseApp.CreateViewFields",
"BaseApp.Delete",
"BaseApp.DeleteAllAuthOriginsByRecord",
"BaseApp.DeleteAllExternalAuthsByRecord",
"BaseApp.DeleteAllMFAsByRecord",
"BaseApp.DeleteAllOTPsByRecord",
"BaseApp.DeleteExpiredMFAs",
"BaseApp.DeleteExpiredOTPs",
"BaseApp.DeleteOldLogs",
"BaseApp.DeleteTable",
"BaseApp.DeleteView",
"BaseApp.DeleteWithContext",
"BaseApp.DryRunView",
"BaseApp.ExpandRecord",
"BaseApp.ExpandRecords",
"BaseApp.FindAllAuthOriginsByCollection",
"BaseApp.FindAllAuthOriginsByRecord",
"BaseApp.FindAllCollections",
"BaseApp.FindAllExternalAuthsByCollection",
"BaseApp.FindAllExternalAuthsByRecord",
"BaseApp.FindAllMFAsByCollection",
"BaseApp.FindAllMFAsByRecord",
"BaseApp.FindAllOTPsByCollection",
"BaseApp.FindAllOTPsByRecord",
"BaseApp.FindAllRecords",
"BaseApp.FindAuthOriginById",
"BaseApp.FindAuthOriginByRecordAndFingerprint",
"BaseApp.FindAuthRecordByEmail",
"BaseApp.FindAuthRecordByToken",
"BaseApp.FindCachedCollectionByNameOrId",
"BaseApp.FindCachedCollectionReferences",
"BaseApp.FindCollectionByNameOrId",
"BaseApp.FindCollectionReferences",
"BaseApp.FindFirstExternalAuthByExpr",
"BaseApp.FindFirstRecordByData",
"BaseApp.FindFirstRecordByFilter",
"BaseApp.FindLogById",
"BaseApp.FindMFAById",
"BaseApp.FindOTPById",
"BaseApp.FindRecordById",
"BaseApp.FindRecordByViewFile",
"BaseApp.FindRecordsByFilter",
"BaseApp.FindRecordsByIds",
"BaseApp.HasTable",
"BaseApp.ImportCollections",
"BaseApp.ImportCollectionsByMarshaledJSON",
"BaseApp.IsCollectionNameUnique",
"BaseApp.LogsStats",
"BaseApp.NewBackupsFilesystem",
"BaseApp.NewFilesystem",
"BaseApp.RecordQuery",
"BaseApp.ReloadCachedCollections",
"BaseApp.ReloadSettings",
"BaseApp.ResetBootstrapState",
"BaseApp.Restart",
"BaseApp.RestoreBackup",
"BaseApp.RunAllMigrations",
"BaseApp.RunAppMigrations",
"BaseApp.RunInTransaction",
"BaseApp.RunSystemMigrations",
"BaseApp.Save",
"BaseApp.SaveNoValidate",
"BaseApp.SaveNoValidateWithContext",
"BaseApp.SaveView",
"BaseApp.SaveWithContext",
"BaseApp.SyncRecordTableSchema",
"BaseApp.TableColumns",
"BaseApp.TableIndexes",
"BaseApp.TableInfo",
"BaseApp.TruncateCollection",
"BaseApp.Vacuum",
"BaseApp.Validate",
"BaseApp.ValidateWithContext",
"BaseApp.initLogger",
"BatchConfig.Validate",
"BoolField.PrepareValue",
"BoolField.ValidateSettings",
"Collection.AddIndex",
"Collection.DBExport",
"Collection.GetIndex",
"Collection.MarshalJSON",
"Collection.PostScan",
"Collection.RemoveIndex",
"Collection.String",
"Collection.UnmarshalJSON",
"DateField.PrepareValue",
"DateField.ValidateSettings",
"DateField.ValidateValue",
"DefaultDBConnect",
"DefaultFieldHelpValidationRule",
"DefaultFieldIdValidationRule",
"DefaultFieldNameValidationRule",
"EditorField.PrepareValue",
"EditorField.ValidateSettings",
"EmailField.PrepareValue",
"EmailField.ValidateSettings",
"EmailField.ValidateValue",
"EmailTemplate.Resolve",
"EmailTemplate.Validate",
"ExternalAuth.CollectionRef",
"ExternalAuth.Created",
"ExternalAuth.Provider",
"ExternalAuth.ProviderId",
"ExternalAuth.RecordRef",
"ExternalAuth.SetCollectionRef",
"ExternalAuth.SetProvider",
"ExternalAuth.SetProviderId",
"ExternalAuth.SetRecordRef",
"ExternalAuth.Updated",
"FieldsList.Add",
"FieldsList.AddAt",
"FieldsList.AddMarshaledJSON",
"FieldsList.AddMarshaledJSONAt",
"FieldsList.Clone",
"FieldsList.MarshalJSON",
"FieldsList.Scan",
"FieldsList.String",
"FieldsList.UnmarshalJSON",
"FieldsList.Value",
"FileField.DriverValue",
"FileField.FindGetter",
"FileField.Intercept",
"FileField.PrepareValue",
"FileField.ValidateSettings",
"FileField.ValidateValue",
"GeoPointField.PrepareValue",
"GeoPointField.ValidateSettings",
"InternalRequest.Validate",
"JSONField.PrepareValue",
"JSONField.ValidateSettings",
"JSONField.ValidateValue",
"LogsConfig.Validate",
"MFA.CollectionRef",
"MFA.Created",
"MFA.HasExpired",
"MFA.Method",
"MFA.RecordRef",
"MFA.SetCollectionRef",
"MFA.SetMethod",
"MFA.SetRecordRef",
"MFA.Updated",
"MFAConfig.Validate",
"MetaConfig.Validate",
"MigrationsRunner.Down",
"MigrationsRunner.RemoveMissingAppliedMigrations",
"MigrationsRunner.Run",
"MigrationsRunner.Up",
"NewAuthCollection",
"NewAuthOrigin",
"NewBaseApp",
"NewBaseCollection",
"NewCollection",
"NewExternalAuth",
"NewFieldsList",
"NewMFA",
"NewOTP",
"NewRecord",
"NewRecordFieldResolver",
"NewViewCollection",
"NumberField.PrepareValue",
"NumberField.ValidateSettings",
"OAuth2Config.Validate",
"OAuth2ProviderConfig.InitProvider",
"OAuth2ProviderConfig.Validate",
"OTP.CollectionRef",
"OTP.Created",
"OTP.HasExpired",
"OTP.RecordRef",
"OTP.SentTo",
"OTP.SetCollectionRef",
"OTP.SetRecordRef",
"OTP.SetSentTo",
"OTP.Updated",
"OTPConfig.Validate",
"PasswordAuthConfig.Validate",
"PasswordField.Intercept",
"PasswordField.PrepareValue",
"PasswordField.ValidateSettings",
"PasswordField.ValidateValue",
"PasswordFieldValue.Validate",
"RateLimitRule.String",
"RateLimitRule.Validate",
"RateLimitsConfig.MarshalJSON",
"RateLimitsConfig.Validate",
"Record.BaseFilesPath",
"Record.Clone",
"Record.DBExport",
"Record.Email",
"Record.EmailVisibility",
"Record.FieldsData",
"Record.FindFileFieldByFile",
"Record.Fresh",
"Record.Get",
"Record.GetBool",
"Record.GetDateTime",
"Record.GetFloat",
"Record.GetGeoPoint",
"Record.GetInt",
"Record.GetString",
"Record.GetStringSlice",
"Record.GetUnsavedFiles",
"Record.GetUploadedFiles",
"Record.Load",
"Record.MarshalJSON",
"Record.NewAuthToken",
"Record.NewEmailChangeToken",
"Record.NewFileToken",
"Record.NewPasswordResetToken",
"Record.NewStaticAuthToken",
"Record.NewVerificationToken",
"Record.Original",
"Record.PostScan",
"Record.PublicExport",
"Record.RefreshTokenKey",
"Record.ReplaceModifiers",
"Record.Set",
"Record.SetEmail",
"Record.SetEmailVisibility",
"Record.SetIfFieldExists",
"Record.SetPassword",
"Record.SetRandomPassword",
"Record.SetRaw",
"Record.SetTokenKey",
"Record.SetVerified",
"Record.TokenKey",
"Record.UnmarshalJSON",
"Record.UnmarshalJSONField",
"Record.ValidatePassword",
"Record.Verified",
"RecordFieldResolver.Resolve",
"RecordFieldResolver.UpdateQuery",
"RelationField.DriverValue",
"RelationField.PrepareValue",
"RelationField.ValidateSettings",
"RelationField.ValidateValue",
"RequestEvent.RealIP",
"RequestEvent.RequestInfo",
"RequestInfo.Clone",
"S3Config.Validate",
"SMTPConfig.MarshalJSON",
"SMTPConfig.Validate",
"SelectField.DriverValue",
"SelectField.PrepareValue",
"SelectField.ValidateSettings",
"SelectField.ValidateValue",
"Settings.Clone",
"Settings.DBExport",
"Settings.MarshalJSON",
"Settings.Merge",
"Settings.PostValidate",
"Settings.String",
"TextField.Intercept",
"TextField.PrepareValue",
"TextField.ValidatePlainValue",
"TextField.ValidateSettings",
"TextField.ValidateValue",
"TokenConfig.Validate",
"TrustedProxyConfig.MarshalJSON",
"URLField.PrepareValue",
"URLField.ValidateSettings",
"URLField.ValidateValue",
"createNotifyDirWatcher",
"dualDBBuilder.AddColumn",
"dualDBBuilder.AddForeignKey",
"dualDBBuilder.AddPrimaryKey",
"dualDBBuilder.AlterColumn",
"dualDBBuilder.CreateIndex",
"dualDBBuilder.CreateTable",
"dualDBBuilder.CreateUniqueIndex",
"dualDBBuilder.Delete",
"dualDBBuilder.DropColumn",
"dualDBBuilder.DropForeignKey",
"dualDBBuilder.DropIndex",
"dualDBBuilder.DropPrimaryKey",
"dualDBBuilder.DropTable",
"dualDBBuilder.GeneratePlaceholder",
"dualDBBuilder.Insert",
"dualDBBuilder.Model",
"dualDBBuilder.NewQuery",
"dualDBBuilder.RenameColumn",
"dualDBBuilder.RenameTable",
"dualDBBuilder.TruncateTable",
"dualDBBuilder.Update",
"dualDBBuilder.Upsert",
"fieldWithType.UnmarshalJSON",
"replaceWithExpression.Build"
]
},
{
"path": "github.com/pocketbase/pocketbase/daos",
"symbols": [
"Dao.parseQueryToFields"
]
},
{
"path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3lite",
"symbols": [
"writer.open"
]
},
{
"path": "github.com/pocketbase/pocketbase/apis",
"symbols": [
"backupApi.restore",
"batchProcessor.Process",
"realtimeBroadcastDryCacheKey",
"realtimeBroadcastRecord",
"realtimeUnsetClientsAuthByCollection",
"realtimeUnsetClientsAuthByRecordModelOrProxy",
"realtimeUnsetDryCacheKey",
"realtimeUpdateClientsAuth"
]
},
{
"path": "github.com/pocketbase/pocketbase",
"symbols": [
"New",
"NewWithConfig",
"PocketBase.Execute",
"PocketBase.Start",
"coloredWriter.Write"
]
},
{
"path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob",
"symbols": [
"writer.Close",
"writer.Write",
"writer.open"
]
},
{
"path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3",
"symbols": [
"Uploader.Upload",
"Uploader.multipartUpload"
]
}
]
}