CVE-2026-39817

MediumCVSS 5.9/10Last modified Nov 11, 2026

Description

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.25.10; >= 1.26.0-0, < 1.26.3

References

https://go.dev/cl/767520Patch
https://go.dev/issue/78778Issue Tracking
https://groups.google.com/g/golang-announce/c/qcCIEXso47MIssue Tracking, Mailing List
https://pkg.go.dev/vuln/GO-2026-4979Vendor Advisory

Timeline

Published: May 7, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-398195.3The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with ac CVE-2026-39824.3A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2026-398207.5Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocati CVE-2026-398219.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("x CVE-2026-398227.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of CVE-2026-398236.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL conte CVE-2026-398243.3NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStri CVE-2026-398255.3ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director fu CVE-2026-398266.1If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespac CVE-2026-398276.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually cra CVE-2026-398286.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded,CVE-2026-398297.5The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or