CVSS 3.1
5.3 mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:NCVE-2026-39819
Medium (5.3) in golang go. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in toolchain 1.25.10, 1.26.3.
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWE
- CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Affected
- golang:go
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2026-4978 | Go | toolchain | <1.25.10 >=1.26.0-0 <1.26.3 | 1.25.10, 1.26.3 |