medium5.9
CVE-2026-39817
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames.
Impact
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Golang | Go | before 1.25.10 from 1.26.0 before 1.26.3 |