CVE-2026-39817 — Invoking "go tool pack" does not sanitize output paths in cmd/go
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive f…
Published: 2026-05-07 · CVSS: 5.9 · CVSS 3.1
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7