Invoking "go tool pack" does not sanitize output paths in cmd/go
cve-program · CVE-2026-39817
PublishedThe "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Read the publisher's advisoryeuvd · EUVD-2026-28421
PublishedThe "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Read the publisher's advisorynvd · CVE-2026-39817
PublishedThe "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Read the publisher's advisoryosv · GO-2026-4979
PublishedThe "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-39817 · CVE overview and exploitation status
cve-program · CVE-2026-39817
- https://go.dev/issue/78778
- https://go.dev/cl/767520
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4979
euvd · EUVD-2026-28421
- https://go.dev/issue/78778
- https://go.dev/cl/767520
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4979
nvd · CVE-2026-39817
- https://go.dev/cl/767520
- https://go.dev/issue/78778
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4979
osv · GO-2026-4979
Related changes
Linked by CVE identifierNo related changes are available here.