CVE-2026-39819 — Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can c…
Published: 2026-05-07 · CVSS: 5.3 · CVSS 3.1
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7