CVE-2026-39817Medium· 5.9▾ SunlitInvoking "go tool pack" does not sanitize output paths in cmd/go
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
— → 5.9
none → medium
5.9 → —
medium → none
— → 5.9
none → medium
Last analysed / modified upstream
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
toolchain >= 1.26.0-0, < 1.26.3Upgrade to a patched release:
toolchain 1.26.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39819Medium· 4.4Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
CVE-2026-94447High· 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum
CVE-2026-94444High· 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place
CVE-2020-27534Medium· 5.3moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathname (CVE-2020-27534)
CVE-2023-35946Medium· 6.9Gradle is a build tool with a focus on build automation and support for multi-language development
CVE-2023-27534High· 8.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indic…