Go toolchain cmd/go CVE-2026-39817

Exploitation requires all of the following: (1) Local filesystem access to the victim system where Go toolchain is installed; (2) User-level or higher privileges to run the 'go tool pack' subcommand (non-root execution is sufficient); (3) User interaction to explicitly invoke 'go tool pack' on a malicious archive file (the subcommand is not automatically triggered by normal Go workflows); (4) A crafted archive containing relative path traversal sequences in its internal filename metadata. Exploitation does NOT require network access, administrative privilege, or authentication to a service. The vulnerability is NOT present in default configurations if users do not manually run 'go tool pack' on untrusted archives - the tool is primarily an internal compiler utility not exposed through typical go build workflows.

This vulnerability presents limited real-world risk despite a moderate CVSS score of 5.9, supported by convergent signals from multiple frameworks. The EPSS score of 0.03% (8th percentile) indicates very low exploitation probability in the wild. The SSVC decision framework reinforces this assessment with 'none' exploitation status, 'no' automatable exploitation, and 'partial' technical impact, suggesting targeted rather than widespread attacks. The CVSS vector itself constrains the threat: local-only attack vector (AV:L) eliminates remote exploitation entirely, and the requirement for user interaction (UI:R) and low privilege (PR:L) means exploitation depends on convincing a user to extract a malicious archive through the pack subcommand. The scope change (S:C) indicates impact beyond the vulnerable component, but integrity impact (I:H) is offset by no confidentiality or availability damage. The combination of strict prerequisites (local access + user interaction + non-default tool usage) and negligible EPSS probability suggests this is a real but narrow vulnerability primarily affecting development workflows where untrusted archives are processed.

An attacker creates a malicious Go archive file (.a) containing path traversal sequences in filenames (e.g., '../../../tmp/injected_file'). A developer or build system unknowingly extracts this archive using 'go tool pack', and the unvalidated filenames cause the tool to write files outside the intended extraction directory, potentially overwriting critical build artifacts, configuration files, or source code. User interaction is required to invoke the pack subcommand on the malicious archive.