CVE-2026-39817: Invoking "go tool pack" does not sanitize output paths in cmd/go
Invoking "go tool pack" does not sanitize output paths in cmd/go
Other sources
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39817?
CVE-2026-39817 has a high severity due to the risk of arbitrary file write vulnerabilities.
How do I fix CVE-2026-39817?
To fix CVE-2026-39817, update to the latest version of Go where this vulnerability has been addressed.
What are the risks associated with CVE-2026-39817?
The risks include unauthorized file overwrites and potential execution of malicious code.
Who is affected by CVE-2026-39817?
Developers using the 'go tool pack' command in vulnerable versions of Go are affected by CVE-2026-39817.
Is CVE-2026-39817 exploitable remotely?
CVE-2026-39817 is not typically exploitable remotely, as it generally requires local access to a vulnerable system.