CVE-2026-39817

The record

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Affected packages

Related vulnerabilities

• CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
• CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
• CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects go1.25
• CVE-2026-42501 A malicious module proxy can exploit a flaw in the go command's validation of module… Also affects go1.25
• CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address… Also affects go1.25
• CVE-2026-39819 The "go bug" command writes to two files with predictable names in the system temporary… Also affects go1.25
• CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to… Also affects go1.25
• CVE-2026-39826 If a trusted template author were to write a tag containing an empty 'type' attribute or… Also affects go1.25