CVE-2026-39817: Invoking "go tool pack" does not sanitize output paths in cmd/go
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39817?
CVE-2026-39817 has a high severity due to the risk of arbitrary file write vulnerabilities.
How do I fix CVE-2026-39817?
To fix CVE-2026-39817, update to the latest version of Go where this vulnerability has been addressed.
What are the risks associated with CVE-2026-39817?
The risks include unauthorized file overwrites and potential execution of malicious code.
Who is affected by CVE-2026-39817?
Developers using the 'go tool pack' command in vulnerable versions of Go are affected by CVE-2026-39817.
Is CVE-2026-39817 exploitable remotely?
CVE-2026-39817 is not typically exploitable remotely, as it generally requires local access to a vulnerable system.