CVE-2026-39819 PUBLISHED

Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

Assigner: Go
Reserved: 07.04.2026 Published: 07.05.2026 Updated: 07.05.2026

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Product Status

Vendor Go toolchain
Product cmd/go
Versions Default: unaffected
  • affected from 0 to 1.25.10 (excl.)
  • affected from 1.26.0-0 to 1.26.3 (excl.)

Credits

  • Harshit Gupta (Mr HAX)

References

Problem Types

  • CWE-377: Insecure Temporary File