5.9Mittel

CVE-2026-39817Invoking "go tool pack" does not sanitize output paths in cmd/go

Go toolchain cmd/go Veröffentlicht: 2026-05-07 22:41 (vor 6 Monaten)

Beschreibung

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Schwachstellentyp (CWE): CWE-22 CWE-787

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Go toolchain	cmd/go	< 1.25.10, 1.26.0-0 – < 1.26.3
golang	go	< 1.25.10

Referenzen und Patches

https://go.dev/issue/78778 Issue Tracking
https://go.dev/cl/767520 Patch
https://groups.google.com/g/golang-announce/c/qcCIEXso47M Issue TrackingMailing List
https://pkg.go.dev/vuln/GO-2026-4979 Vendor Advisory

CPE-Treffer (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.10
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.3

CVSS-Score

5.9Mittel

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Keine
Integrität: Hoch
Verfügbarkeit: Keine

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Alle Scores (3)

CISA-ADP	CVSS 3.1	5.9Mittel
nvd	CVSS 3.1	5.9Mittel
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.9Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.17%

höher als 6 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-04-07
Veröffentlicht2026-05-07 22:41
Bei IP-DB eingegangen2026-10-24 23:50
Zuletzt aktualisiert2026-06-17 13:42

Vergeben von (CNA): Go
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Go

Ohne Score

CVE-2026-97033 vor 12 Stunden

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Ohne Score

CVE-2026-97034 vor 12 Stunden

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Ohne Score

CVE-2026-97054 vor 12 Stunden

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Ohne Score

CVE-2026-97035 vor 12 Stunden

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Ohne Score

CVE-2026-97036 vor 12 Stunden

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Ohne Score

CVE-2026-97037 vor 12 Stunden

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…