CVE-2026-39817

EPSS 0.01%
Veröffentlicht 07.05.2026 19:41:18
Zuletzt bearbeitet 13.05.2026 14:59:28
Quelle security@golang.org
CVE-Watchlists
Login
Unerledigt
Login

Invoking "go tool pack" does not sanitize output paths in cmd/go

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Golang ≫ Go Version < 1.25.10

Golang ≫ Go Version >= 1.26.0 < 1.26.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.027

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.9	1.5	4	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.9	1.5	4	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N