Invoking "go tool pack" does not sanitize output paths in cmd/go

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-39817 · CVE overview and exploitation status

EUVD-2026-28421

GO-2026-4979

BIT-golang-2026-39817

cve-program · CVE-2026-39817

• https://go.dev/issue/78778
• https://go.dev/cl/767520
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4979

euvd · EUVD-2026-28421

• https://go.dev/issue/78778
• https://go.dev/cl/767520
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4979

nvd · CVE-2026-39817

• https://go.dev/cl/767520
• https://go.dev/issue/78778
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4979

osv · GO-2026-4979

• https://go.dev/issue/78778
• https://go.dev/cl/767520
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

No related changes are available here.