Go toolchain cmd/go CVE-2026-39819

Exploitation requires: (1) local system access (AV:L per CVSS vector), (2) write permissions to the system temporary directory or the ability to pre-create files/symlinks there, (3) knowledge or discovery of the predictable temporary file names used by 'go bug', and (4) execution of the 'go bug' command by a legitimate user or automated process. The high attack complexity (AC:H) reflects the need to successfully place a symlink before the legitimate process writes to the same path-a race condition or careful timing scenario. Non-default configurations do not mitigate this; the vulnerability exists in default installations. Exploitation is limited by: absence of network attack vector (local-only), requirement for prior local access, need for user or process to execute 'go bug' (which is not a background daemon), and reduced impact if the temp directory has restricted permissions.

Risk assessment presents conflicting signals requiring careful interpretation. CVSS 5.3 with AV:L (local attack vector) and AC:H (high attack complexity) reflects moderate severity, while EPSS 0.01% (first percentile) indicates very low real-world exploitation probability-consistent with CISA SSVC decision 'Exploitation: none' and 'Automatable: no'. The 'Automatable: no' rating is critical; this attack requires local system access, precise timing or pre-placement of symlinks, and knowledge of the temporary file names. However, the 'Technical Impact: partial' acknowledges that successful exploitation enables arbitrary file overwrite. Risk is concentrated in shared-system environments (CI/CD pipelines, multi-user development machines, containerized builds) where attackers already have local filesystem access. The very low EPSS and absence from KEV suggest this is not being actively exploited in the wild, likely because the prerequisites (local access + temp directory write + symlink placement) are difficult to achieve without detection. Priority is medium-low for most organizations but higher for systems running untrusted code or with weak temp directory isolation.

An attacker with local access to a shared development machine or CI/CD runner prepares symlinks at the predictable paths where 'go bug' writes (e.g., /tmp/goprofiling.txt, /tmp/goreport.txt) pointing to sensitive files such as ~/.ssh/id_rsa or /etc/passwd. When a developer or automated build system runs 'go bug', the command overwrites the symlink targets with diagnostic output and system environment data, allowing the attacker to corrupt or access sensitive file contents through the bug report output.