Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-39819 The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Description

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Produits et versions touchés

Produit Versions touchées Corrigé en
cmd/go 1.26 1.26.0-0 → < 1.26.3 1.26.3
cmd/go 1.25 premières → < 1.25.10 1.25.10

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de cmd/go

Les 23 CVE de cmd/go →
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a… 7.8 Élevée CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and… 7.8 Élevée CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to… 8.4 Élevée CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log 7.5 Élevée
Suivre cette CVE