Description
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Affected products
golang: go
References4
- pkg.go.dev/vuln/GO-2026-4979 Vendor Advisory
- go.dev/cl/767520 Patch
- go.dev/issue/78778 Issue Tracking
- groups.google.com/g/golang-announce/c/qcCIEXso47M Issue TrackingMailing List
Metrics
- CVSS 3.1
-
5.9
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 6 · as of 13 November 2026
- CWE
- CWE-787
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.