Go Toolchain Pack Subcmd Arbitrary File Write (1.251.26.2)
CVE-2026-39817 Published on May 7, 2026

Invoking "go tool pack" does not sanitize output paths in cmd/go
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

NVD

Vulnerability Analysis

CVE-2026-39817 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Products Associated with CVE-2026-39817

Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.

GoLang Go
 

Affected Versions

Go toolchain cmd/go: