Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase

{
  "id": "6b762844a50bf62a8634afa453780385b8c6bdbac1a1252bd82db6fc3d8b6cc6",
  "url": "https://osv.dev/vulnerability/GO-2026-6489",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase",
    "summary": "Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase",
    "evidence": "osv:GO-2026-6489",
    "products": [
      {
        "name": {
          "value": "github.com/pocketbase/pocketbase",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.22.48",
            "evidence": "/affected/0/ranges"
          },
          {
            "value": "0.39.7",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6489",
      "aliases": [
        "CVE-2026-82410",
        "GHSA-84vh-m24q-wjjx",
        "GO-2026-6489"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.22.48"
                },
                {
                  "introduced": "0.23.0"
                },
                {
                  "fixed": "0.39.7"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/pocketbase/pocketbase",
            "purl": "pkg:golang/github.com/pocketbase/pocketbase",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6489.json"
          },
          "ecosystem_specific": {
            "imports": [
              {
                "path": "github.com/pocketbase/pocketbase/tools/cron",
                "symbols": [
                  "Cron.SetInterval",
                  "Cron.Start"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/tools/search",
                "symbols": [
                  "Provider.Exec",
                  "Provider.ParseAndExec"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/plugins/jsvm",
                "symbols": [
                  "BindApis",
                  "BindCore",
                  "BindDbx",
                  "BindFilepath",
                  "BindFilesystem",
                  "BindForms",
                  "BindHTTP",
                  "BindMails",
                  "BindOS",
                  "BindSecurity",
                  "MustRegister",
                  "Register",
                  "plugin.watchHooks"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/core",
                "symbols": [
                  "AuthAlertConfig.Validate",
                  "AuthOrigin.CollectionRef",
                  "AuthOrigin.Created",
                  "AuthOrigin.Fingerprint",
                  "AuthOrigin.RecordRef",
                  "AuthOrigin.SetCollectionRef",
                  "AuthOrigin.SetFingerprint",
                  "AuthOrigin.SetRecordRef",
                  "AuthOrigin.Updated",
                  "AutodateField.Intercept",
                  "AutodateField.PrepareValue",
                  "AutodateField.ValidateSettings",
                  "BackupsConfig.Validate",
                  "BaseApp.AuxDelete",
                  "BaseApp.AuxDeleteWithContext",
                  "BaseApp.AuxHasTable",
                  "BaseApp.AuxRunInTransaction",
                  "BaseApp.AuxSave",
                  "BaseApp.AuxSaveNoValidate",
                  "BaseApp.AuxSaveNoValidateWithContext",
                  "BaseApp.AuxSaveWithContext",
                  "BaseApp.AuxVacuum",
                  "BaseApp.Bootstrap",
                  "BaseApp.CanAccessRecord",
                  "BaseApp.CountRecords",
                  "BaseApp.CreateBackup",
                  "BaseApp.CreateViewFields",
                  "BaseApp.Delete",
                  "BaseApp.DeleteAllAuthOriginsByRecord",
                  "BaseApp.DeleteAllExternalAuthsByRecord",
                  "BaseApp.DeleteAllMFAsByRecord",
                  "BaseApp.DeleteAllOTPsByRecord",
                  "BaseApp.DeleteExpiredMFAs",
                  "BaseApp.DeleteExpiredOTPs",
                  "BaseApp.DeleteOldLogs",
                  "BaseApp.DeleteTable",
                  "BaseApp.DeleteView",
                  "BaseApp.DeleteWithContext",
                  "BaseApp.DryRunView",
                  "BaseApp.ExpandRecord",
                  "BaseApp.ExpandRecords",
                  "BaseApp.FindAllAuthOriginsByCollection",
                  "BaseApp.FindAllAuthOriginsByRecord",
                  "BaseApp.FindAllCollections",
                  "BaseApp.FindAllExternalAuthsByCollection",
                  "BaseApp.FindAllExternalAuthsByRecord",
                  "BaseApp.FindAllMFAsByCollection",
                  "BaseApp.FindAllMFAsByRecord",
                  "BaseApp.FindAllOTPsByCollection",
                  "BaseApp.FindAllOTPsByRecord",
                  "BaseApp.FindAllRecords",
                  "BaseApp.FindAuthOriginById",
                  "BaseApp.FindAuthOriginByRecordAndFingerprint",
                  "BaseApp.FindAuthRecordByEmail",
                  "BaseApp.FindAuthRecordByToken",
                  "BaseApp.FindCachedCollectionByNameOrId",
                  "BaseApp.FindCachedCollectionReferences",
                  "BaseApp.FindCollectionByNameOrId",
                  "BaseApp.FindCollectionReferences",
                  "BaseApp.FindFirstExternalAuthByExpr",
                  "BaseApp.FindFirstRecordByData",
                  "BaseApp.FindFirstRecordByFilter",
                  "BaseApp.FindLogById",
                  "BaseApp.FindMFAById",
                  "BaseApp.FindOTPById",
                  "BaseApp.FindRecordById",
                  "BaseApp.FindRecordByViewFile",
                  "BaseApp.FindRecordsByFilter",
                  "BaseApp.FindRecordsByIds",
                  "BaseApp.HasTable",
                  "BaseApp.ImportCollections",
                  "BaseApp.ImportCollectionsByMarshaledJSON",
                  "BaseApp.IsCollectionNameUnique",
                  "BaseApp.LogsStats",
                  "BaseApp.NewBackupsFilesystem",
                  "BaseApp.NewFilesystem",
                  "BaseApp.RecordQuery",
                  "BaseApp.ReloadCachedCollections",
                  "BaseApp.ReloadSettings",
                  "BaseApp.ResetBootstrapState",
                  "BaseApp.Restart",
                  "BaseApp.RestoreBackup",
                  "BaseApp.RunAllMigrations",
                  "BaseApp.RunAppMigrations",
                  "BaseApp.RunInTransaction",
                  "BaseApp.RunSystemMigrations",
                  "BaseApp.Save",
                  "BaseApp.SaveNoValidate",
                  "BaseApp.SaveNoValidateWithContext",
                  "BaseApp.SaveView",
                  "BaseApp.SaveWithContext",
                  "BaseApp.SyncRecordTableSchema",
                  "BaseApp.TableColumns",
                  "BaseApp.TableIndexes",
                  "BaseApp.TableInfo",
                  "BaseApp.TruncateCollection",
                  "BaseApp.Vacuum",
                  "BaseApp.Validate",
                  "BaseApp.ValidateWithContext",
                  "BaseApp.initLogger",
                  "BatchConfig.Validate",
                  "BoolField.PrepareValue",
                  "BoolField.ValidateSettings",
                  "Collection.AddIndex",
                  "Collection.DBExport",
                  "Collection.GetIndex",
                  "Collection.MarshalJSON",
                  "Collection.PostScan",
                  "Collection.RemoveIndex",
                  "Collection.String",
                  "Collection.UnmarshalJSON",
                  "DateField.PrepareValue",
                  "DateField.ValidateSettings",
                  "DateField.ValidateValue",
                  "DefaultDBConnect",
                  "DefaultFieldHelpValidationRule",
                  "DefaultFieldIdValidationRule",
                  "DefaultFieldNameValidationRule",
                  "EditorField.PrepareValue",
                  "EditorField.ValidateSettings",
                  "EmailField.PrepareValue",
                  "EmailField.ValidateSettings",
                  "EmailField.ValidateValue",
                  "EmailTemplate.Resolve",
                  "EmailTemplate.Validate",
                  "ExternalAuth.CollectionRef",
                  "ExternalAuth.Created",
                  "ExternalAuth.Provider",
                  "ExternalAuth.ProviderId",
                  "ExternalAuth.RecordRef",
                  "ExternalAuth.SetCollectionRef",
                  "ExternalAuth.SetProvider",
                  "ExternalAuth.SetProviderId",
                  "ExternalAuth.SetRecordRef",
                  "ExternalAuth.Updated",
                  "FieldsList.Add",
                  "FieldsList.AddAt",
                  "FieldsList.AddMarshaledJSON",
                  "FieldsList.AddMarshaledJSONAt",
                  "FieldsList.Clone",
                  "FieldsList.MarshalJSON",
                  "FieldsList.Scan",
                  "FieldsList.String",
                  "FieldsList.UnmarshalJSON",
                  "FieldsList.Value",
                  "FileField.DriverValue",
                  "FileField.FindGetter",
                  "FileField.Intercept",
                  "FileField.PrepareValue",
                  "FileField.ValidateSettings",
                  "FileField.ValidateValue",
                  "GeoPointField.PrepareValue",
                  "GeoPointField.ValidateSettings",
                  "InternalRequest.Validate",
                  "JSONField.PrepareValue",
                  "JSONField.ValidateSettings",
                  "JSONField.ValidateValue",
                  "LogsConfig.Validate",
                  "MFA.CollectionRef",
                  "MFA.Created",
                  "MFA.HasExpired",
                  "MFA.Method",
                  "MFA.RecordRef",
                  "MFA.SetCollectionRef",
                  "MFA.SetMethod",
                  "MFA.SetRecordRef",
                  "MFA.Updated",
                  "MFAConfig.Validate",
                  "MetaConfig.Validate",
                  "MigrationsRunner.Down",
                  "MigrationsRunner.RemoveMissingAppliedMigrations",
                  "MigrationsRunner.Run",
                  "MigrationsRunner.Up",
                  "NewAuthCollection",
                  "NewAuthOrigin",
                  "NewBaseApp",
                  "NewBaseCollection",
                  "NewCollection",
                  "NewExternalAuth",
                  "NewFieldsList",
                  "NewMFA",
                  "NewOTP",
                  "NewRecord",
                  "NewRecordFieldResolver",
                  "NewViewCollection",
                  "NumberField.PrepareValue",
                  "NumberField.ValidateSettings",
                  "OAuth2Config.Validate",
                  "OAuth2ProviderConfig.InitProvider",
                  "OAuth2ProviderConfig.Validate",
                  "OTP.CollectionRef",
                  "OTP.Created",
                  "OTP.HasExpired",
                  "OTP.RecordRef",
                  "OTP.SentTo",
                  "OTP.SetCollectionRef",
                  "OTP.SetRecordRef",
                  "OTP.SetSentTo",
                  "OTP.Updated",
                  "OTPConfig.Validate",
                  "PasswordAuthConfig.Validate",
                  "PasswordField.Intercept",
                  "PasswordField.PrepareValue",
                  "PasswordField.ValidateSettings",
                  "PasswordField.ValidateValue",
                  "PasswordFieldValue.Validate",
                  "RateLimitRule.String",
                  "RateLimitRule.Validate",
                  "RateLimitsConfig.MarshalJSON",
                  "RateLimitsConfig.Validate",
                  "Record.BaseFilesPath",
                  "Record.Clone",
                  "Record.DBExport",
                  "Record.Email",
                  "Record.EmailVisibility",
                  "Record.FieldsData",
                  "Record.FindFileFieldByFile",
                  "Record.Fresh",
                  "Record.Get",
                  "Record.GetBool",
                  "Record.GetDateTime",
                  "Record.GetFloat",
                  "Record.GetGeoPoint",
                  "Record.GetInt",
                  "Record.GetString",
                  "Record.GetStringSlice",
                  "Record.GetUnsavedFiles",
                  "Record.GetUploadedFiles",
                  "Record.Load",
                  "Record.MarshalJSON",
                  "Record.NewAuthToken",
                  "Record.NewEmailChangeToken",
                  "Record.NewFileToken",
                  "Record.NewPasswordResetToken",
                  "Record.NewStaticAuthToken",
                  "Record.NewVerificationToken",
                  "Record.Original",
                  "Record.PostScan",
                  "Record.PublicExport",
                  "Record.RefreshTokenKey",
                  "Record.ReplaceModifiers",
                  "Record.Set",
                  "Record.SetEmail",
                  "Record.SetEmailVisibility",
                  "Record.SetIfFieldExists",
                  "Record.SetPassword",
                  "Record.SetRandomPassword",
                  "Record.SetRaw",
                  "Record.SetTokenKey",
                  "Record.SetVerified",
                  "Record.TokenKey",
                  "Record.UnmarshalJSON",
                  "Record.UnmarshalJSONField",
                  "Record.ValidatePassword",
                  "Record.Verified",
                  "RecordFieldResolver.Resolve",
                  "RecordFieldResolver.UpdateQuery",
                  "RelationField.DriverValue",
                  "RelationField.PrepareValue",
                  "RelationField.ValidateSettings",
                  "RelationField.ValidateValue",
                  "RequestEvent.RealIP",
                  "RequestEvent.RequestInfo",
                  "RequestInfo.Clone",
                  "S3Config.Validate",
                  "SMTPConfig.MarshalJSON",
                  "SMTPConfig.Validate",
                  "SelectField.DriverValue",
                  "SelectField.PrepareValue",
                  "SelectField.ValidateSettings",
                  "SelectField.ValidateValue",
                  "Settings.Clone",
                  "Settings.DBExport",
                  "Settings.MarshalJSON",
                  "Settings.Merge",
                  "Settings.PostValidate",
                  "Settings.String",
                  "TextField.Intercept",
                  "TextField.PrepareValue",
                  "TextField.ValidatePlainValue",
                  "TextField.ValidateSettings",
                  "TextField.ValidateValue",
                  "TokenConfig.Validate",
                  "TrustedProxyConfig.MarshalJSON",
                  "URLField.PrepareValue",
                  "URLField.ValidateSettings",
                  "URLField.ValidateValue",
                  "createNotifyDirWatcher",
                  "dualDBBuilder.AddColumn",
                  "dualDBBuilder.AddForeignKey",
                  "dualDBBuilder.AddPrimaryKey",
                  "dualDBBuilder.AlterColumn",
                  "dualDBBuilder.CreateIndex",
                  "dualDBBuilder.CreateTable",
                  "dualDBBuilder.CreateUniqueIndex",
                  "dualDBBuilder.Delete",
                  "dualDBBuilder.DropColumn",
                  "dualDBBuilder.DropForeignKey",
                  "dualDBBuilder.DropIndex",
                  "dualDBBuilder.DropPrimaryKey",
                  "dualDBBuilder.DropTable",
                  "dualDBBuilder.GeneratePlaceholder",
                  "dualDBBuilder.Insert",
                  "dualDBBuilder.Model",
                  "dualDBBuilder.NewQuery",
                  "dualDBBuilder.RenameColumn",
                  "dualDBBuilder.RenameTable",
                  "dualDBBuilder.TruncateTable",
                  "dualDBBuilder.Update",
                  "dualDBBuilder.Upsert",
                  "fieldWithType.UnmarshalJSON",
                  "replaceWithExpression.Build"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/daos",
                "symbols": [
                  "Dao.parseQueryToFields"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3lite",
                "symbols": [
                  "writer.open"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/apis",
                "symbols": [
                  "backupApi.restore",
                  "batchProcessor.Process",
                  "realtimeBroadcastDryCacheKey",
                  "realtimeBroadcastRecord",
                  "realtimeUnsetClientsAuthByCollection",
                  "realtimeUnsetClientsAuthByRecordModelOrProxy",
                  "realtimeUnsetDryCacheKey",
                  "realtimeUpdateClientsAuth"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase",
                "symbols": [
                  "New",
                  "NewWithConfig",
                  "PocketBase.Execute",
                  "PocketBase.Start",
                  "coloredWriter.Write"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob",
                "symbols": [
                  "writer.Close",
                  "writer.Write",
                  "writer.open"
                ]
              },
              {
                "path": "github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3",
                "symbols": [
                  "Uploader.Upload",
                  "Uploader.multipartUpload"
                ]
              }
            ]
          }
        }
      ],
      "modified": "2026-10-07T17:45:12.818270704Z",
      "provider": "osv",
      "references": [
        "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx",
        "https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220",
        "https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95",
        "https://github.com/pocketbase/pocketbase/discussions/7762",
        "https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48",
        "https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6489",
        "review_status": "REVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82410",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97102,
  "published_at": "2026-10-07T14:10:35+00:00"
}