{"id":"GO-2026-6893","title":"Event type spoofing via UntrustedType in github.com/google/go-eventlog","summary":"Event type spoofing via UntrustedType in github.com/google/go-eventlog","severity":"none","vendor":"google","product":"github.com/google/go-eventlog","ecosystem":"go","affected":["github.com/google/go-eventlog < 0.0.3-0.20261001001437-1991f15bc4b0"],"patched":["github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T23:15:15.415643261Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6893","references":[{"url":"https://github.com/google/go-eventlog/commit/1991f15bc4b01cffc4e329e9e532c1ae930ae5aa"},{"url":"https://github.com/google/go-eventlog/pull/39"},{"url":"https://github.com/golang/vulndb/issues/6893"},{"url":"https://bschaatsbergen.com/posts/attacking-rats-verifiers-through-the-tcg-event-log/"}],"tags":["osv","go"],"ingestedAt":"2026-11-07T16:33:46.907Z","slug":"GO-2026-6893","body":"## Overview\n\nIn github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.\n\n## Affected packages\n\n- `github.com/google/go-eventlog < 0.0.3-0.20261001001437-1991f15bc4b0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}