Invoking "go tool pack" does not sanitize output paths in cmd/go

Mô tả

Tham khảo

• go.dev/issue/78778 · REPORT
• go.dev/cl/767520 · FIX
• groups.google.com/g/golang-announce/c/qcCIEXso47M · WEB
• pkg.go.dev/vuln/GO-2026-4979 · Vendor Advisory

Lỗ hổng khác của toolchain

• CVE-2026-94447CAO 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a maliciou…
• CVE-2026-94444CAO 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY th…
• CVE-2026-56865CAO 8.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an…
• CVE-2026-56864CAO 7.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor…
• CVE-2026-42501CAO 7.5A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This …