Vulnerabilities

TI-2026-30784 CVE-2026-42501 · GHSA-qf3q-3h68-mmh2

Malicious module proxy can bypass checksum database in cmd/go

LOW 34

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00231 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-347

TI-2026-28700 CVE-2026-39817 · GHSA-qc64-m6c2-v4x7

LOW 26

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames.

CVSS 3.1MEDIUM 5.9 Local Low privileges User interaction EPSS 0.0017 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-787

TI-2026-28701 CVE-2026-39819 · GHSA-5m4p-2gjx-p2g8

LOW 23

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00179 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-59