Skip to content
fr Sign in
5.9 Medium

CVE-2026-39817 The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not…

Description

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Affected products and versions

Product Affected versions Fixed in
cmd/go 1.26 1.26.0-0 → < 1.26.3 1.26.3
cmd/go 1.25 earliest → < 1.25.10 1.25.10

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cmd/go

The 23 CVEs of cmd/go →
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a… 7.8 High CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and… 7.8 High CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to… 8.4 High CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log 7.5 High
Track this CVE