CVE-2026-39817
CVE-2026-39817 · Invoking "go tool pack" does not sanitize output paths in cmd/go
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
CVSS 5.9 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cmd/go
- Versions
- ≥ 0, < 1.25.10: Affected (semver)
- ≥ 1.26.0-0, < 1.26.3: Affected (semver)
Update to 1.25.10; Update to 1.26.3
golang-1.19 Debian:12
- Versions
- 1.19.10-1
- 1.19.10-2
- 1.19.11-1
- 1.19.12-1
- 1.19.12-2
- 1.19.12-2~bpo11+1
- 1.19.12-2~bpo12+1
- 1.19.13-1
- 1.19.13-1~bpo11+1
- 1.19.13-1~bpo12+1
- 1.19.8-2
- 1.19.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Debian:13
- Versions
- 1.24.12-1
- 1.24.13-1
- 1.24.13-2
- 1.24.4-1
- 1.24.4-2
- 1.24.4-3
- 1.24.4-4
- 1.24.7-1
- 1.24.8-1
- 1.24.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Debian:14
- Versions
- 1.26.0-1
- 1.26.1-1
- 1.26.2-1
- 1.26.2-2
- 1.26.2-3
- 1.26.3-1~bpo13+1
- 1.26~rc2-1
- 1.26~rc3-1
- 1.26~rc3-2
- Affected ranges
- ECOSYSTEM: < 1.26.3-1
Update to 1.26.3-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- 1.18.1-1ubuntu1~16.04.6+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- 1.18.1-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- 1.13.8-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- 1.18.1-1ubuntu1~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.22 Ubuntu:20.04:LTS
- Versions
- 1.22.2-2~20.04.1
- 1.22.2-2~20.04.2
- 1.22.2-2~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- 1.18.1-1ubuntu1.1
- 1.18.1-1ubuntu1.2
- 1.18.1-1ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published