CVE-2026-39817

תיאור (מקור, אנגלית)

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

מדדים

CVSS 3.1

5.9 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-1/8/2026

CWE

CWE-787

מוצרים מושפעים

golang: go

קישורים

• https://pkg.go.dev/vuln/GO-2026-4979 Vendor Advisory
• https://go.dev/cl/767520 Patch
• https://go.dev/issue/78778 Issue Tracking
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M Issue TrackingMailing List