CVE-2026-39819: Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39819?
CVE-2026-39819 has a medium severity rating due to its potential to allow local attackers to execute arbitrary code.
What causes CVE-2026-39819?
CVE-2026-39819 is caused by the "go bug" command following symlinks in predictable temporary filenames.
How do I fix CVE-2026-39819?
To mitigate CVE-2026-39819, avoid using predictable filenames in the temporary directory or update to the latest patched version of Go.
Who is affected by CVE-2026-39819?
Users of the Go cmd/go tool who have access to the temporary directory are affected by CVE-2026-39819.
What type of attack is possible with CVE-2026-39819?
CVE-2026-39819 allows for symbolic link attacks, which can lead to unauthorized file access or code execution.