Уязвимость команды go tool pack языка программирования Go, позволяющая нарушителю получить доступ на чтение и запись произвольных файлов

Уязвимость golang

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Invoking "go tool pack" does not sanitize output paths in cmd/go

The "go tool pack" subcommand (usually used only by the compiler as an ...

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Security update for go1.25

Security update for go1.26

Security update for go1.25-openssl

Security update for go1.26-openssl

Security update for go1.25-openssl

Security update for go1.26-openssl

Security update for go1.25

Security update for go1.26

ELSA-2026-22121: golang security update (IMPORTANT)

ELSA-2026-22120: golang security update (IMPORTANT)

ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)

Security update for go1.26-openssl