5.3Medium

CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

Go toolchain cmd/go Published: 2026-05-07 22:41 (6 months ago)

Description

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Weakness (CWE): CWE-377 CWE-59

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.25.10, 1.26.0-0 – < 1.26.3
golang	go	< 1.25.10

References and patches

https://go.dev/issue/78584 Issue Tracking
https://go.dev/cl/763882 Patch
https://groups.google.com/g/golang-announce/c/qcCIEXso47M Issue TrackingMailing List
https://pkg.go.dev/vuln/GO-2026-4978 Vendor Advisory

CPE matches (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.10
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.3

CVSS score

5.3Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: High
Availability: None

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

All scores (3)

CISA-ADP	CVSS 3.1	5.3Medium
nvd	CVSS 3.1	5.3Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.3Medium

EPSS (chance of exploitation in 30 days)

0.18%

higher than 8% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-04-07
Published2026-05-07 22:41
Reached IP-DB2026-10-24 23:50
Last updated2026-11-12 02:10

Assigned by (CNA): Go
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Go

Unscored

CVE-2026-97033 4 days ago

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Unscored

CVE-2026-97034 4 days ago

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Unscored

CVE-2026-97054 4 days ago

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Unscored

CVE-2026-97035 4 days ago

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Unscored

CVE-2026-97036 4 days ago

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Unscored

CVE-2026-97037 4 days ago

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…