CVSS 3.1
5.9 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:NCVE-2026-39817
Medium (5.9) in golang go. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in toolchain 1.25.10, 1.26.3.
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- golang:go
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2026-4979 | Go | toolchain | <1.25.10 >=1.26.0-0 <1.26.3 | 1.25.10, 1.26.3 |