digitalocean vulnerabilities

Products

• @digitalocean/do-markdownit 1
• @digitalocean/do-markdownit 1
• github.com/digitalocean/droplet-agent 1
• golang-nanoauth 1

Latest digitalocean CVEs

Newest publication first

1. CVE-2026-24516 DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

   Published 2026-03-23

   High·CVSS 8.8 EPSS 2.7% PoC

   A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner component (internal/troubleshooting/actioner/actioner.go) processes metadata from the metadata service endpoint and executes commands specified in the Troubleshootin...

2. CVE-2025-59717 @digitalocean/do-markdownit has Type Confusion vulnerability

   Published 2025-09-19

   Critical·CVSS 9.8 EPSS 0.39%

   In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

3. CVE-2020-36569 Authentication bypass in github.com/nanobox-io/golang-nanoauth

   Published 2022-12-27

   Critical·CVSS 9.1 EPSS 0.88%

   Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.