CVE-2026-39817
MEDIUM5.9EPSS 0.01%Invoking "go tool pack" does not sanitize output paths in cmd/go
Published: 5/7/2026Modified: 5/15/2026
Description
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Affected packages (7)
- Bitnami/golangfrom 0, < 1.25.10, >= 1.26.0-0, < 1.26.3
- Debian/golang-1.15from 0
- Debian/golang-1.19from 0
- Debian/golang-1.24from 0
- Debian/golang-1.25from 0, < 1.25.10-1
- Debian/golang-1.26from 0, < 1.26.3-1
- Go/toolchainfrom 0, < 1.25.10, >= 1.26.0-0, < 1.26.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N |