← Back

CVE-2026-39817

nvd nist
Published: May 7, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Exploitability: 1.5 / Impact: 4.0
Source: NVD

Description

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Affected (2)

Products: Golang: Go
Golang
1 product
Go
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Golang
Go
Before 1.25.10
Go
From 1.26.0 to 1.26.3

Related CWEs

CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

Source: security@golang.org
Patch
Source: security@golang.org
Issue Tracking
Source: security@golang.org
Issue TrackingMailing List
Source: security@golang.org
Vendor Advisory

Timeline

No history available yet.