CVE-2026-39819: Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
Other sources
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39819?
CVE-2026-39819 has a medium severity rating due to its potential to allow local attackers to execute arbitrary code.
What causes CVE-2026-39819?
CVE-2026-39819 is caused by the "go bug" command following symlinks in predictable temporary filenames.
How do I fix CVE-2026-39819?
To mitigate CVE-2026-39819, avoid using predictable filenames in the temporary directory or update to the latest patched version of Go.
Who is affected by CVE-2026-39819?
Users of the Go cmd/go tool who have access to the temporary directory are affected by CVE-2026-39819.
What type of attack is possible with CVE-2026-39819?
CVE-2026-39819 allows for symbolic link attacks, which can lead to unauthorized file access or code execution.