5.9
Moyenne
CVE-2026-39817 The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not…
Description
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Produits et versions touchés
Autres CVE de cmd/go
Les 23 CVE de cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
Élevée
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
Élevée
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
Élevée
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
7.5
Élevée