EUVD-2026-87201
GHSA-f83q-fx9f-w4gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach self-hosted x/playground endpoint
-
DeliverySubmit malicious txtar + go env file
-
ExploitEscape sandbox, write to host $HOME
-
ExecutionTrigger unrestricted go vet path
-
PersistLoad attacker go env config
-
ImpactExecute arbitrary code on playground host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a self-hosted or independent deployment of the golang.org/x/playground package (go.dev/play is explicitly NOT affected), and depends on the attacker's submission reaching one specific vulnerable go-vet invocation path (one of three) that fails to restrict the execution environment. The attacker must supply both a crafted txtar that escapes the execution sandbox to write into the host's trusted filesystem AND a malicious go env configuration file rooted in the host's $HOME; neither alone achieves RCE - the two must be combined. This bounded exposure (self-hosted forks only, specific invocation path, chained conditions) is the primary limiting factor; authentication is not required (PR:N) since the playground accepts arbitrary code submissions. |
| Impact | This is a genuine remote code execution flaw (CWE-20, chained sandbox-escape) but the real-world urgency is materially lower than the 8.8 CVSS suggests. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and 'Technical Impact: total' in SSVC agree that a successful exploit yields full host compromise. However, every non-impact signal points to low priority: SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit code is referenced (only the Go issue tracker and a code-review/patch link). Critically, the description narrows the blast radius sharply - 'This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground' - meaning the canonical hosted service is not vulnerable and only self-hosted forks/deployments of the x/playground package are exposed. One inconsistency worth verifying with the vendor: the vector lists UI:R (user interaction required), yet the described attack is an attacker directly submitting a malicious txtar and go env file to the playground for execution, which typically needs no separate victim - UI:R may be overstated. Overall: patch self-hosted deployments, but this is a bounded, self-hosted-only issue with no evidence of exploitation, not a widespread emergency. |
| Exploit ScenarioDerived | An attacker submits a specially crafted txtar archive plus a malicious 'go env' configuration file to a self-hosted golang.org/x/playground instance's run endpoint. The txtar escapes the intended sandbox to write arbitrary files onto the host's trusted filesystem, and one of the three go-vet invocation paths reads the attacker-planted go env file from the host's $HOME, chaining into arbitrary code execution on the playground host. No public exploit code is identified at time of analysis, and go.dev/play itself is not affected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.
RemediationAI
Apply the vendor-released patch by upgrading golang.org/x/playground to version 0.0.0-20260924211604-6d73cff14c17 (commit 6d73cff14c17) or later; the fix changelist is documented at https://go.dev/cl/838485 with tracking in https://go.dev/issue/81737, and any fork that vendors the package must pull that commit rather than relying on an older pseudo-version pin. Because exploitation requires a successful write into the host's trusted filesystem followed by an under-restricted go vet run, operators who cannot patch immediately should address both halves of the chain: run all submission-compilation and vet work in a disposable, least-privilege container with the trusted filesystem mounted read-only and $HOME pointed at a non-persistent, attacker-inaccessible path, which breaks the second primitive but costs you the ability to cache vet results or toolchain state between runs; alternatively disable or bypass the vulnerable go vet invocation path in the three-path dispatch (accepting reduced linting coverage for submitted snippets as the trade-off) so untrusted code never executes with the host's environment file in scope; and scrub or ignore environment configuration files under $HOME when spawning toolchain processes, which prevents a dropped go env file from influencing execution but may change build behavior for legitimate custom configurations. Note that WAF-style filtering of txtar uploads is not a reliable control because the archive is a valid container format and the escape depends on host-side handling, not on request payload signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-20 (Improper Input Validation): the playground accepts arbitrary untrusted user submissions (the CVSS vector confirms no privileges are required, PR:N) but fails to fully validate or confine how those submissions are handled by the host's toolchain. Two distinct validation gaps combine. First, the txtar archive format - a simple multi-file text archive used by the Go toolchain - can be crafted so that extraction escapes the intended execution context and writes arbitrary files onto the playground host's trusted filesystem, a classic path/context confinement failure. Second, one of the three code paths that invoke 'go vet' on the playground host does not correctly restrict the execution environment, so the resulting Go process is able to read an environment configuration file (the go env file) rooted in the host's $HOME directory. Because Go's environment files can influence toolchain behavior, a well-crafted go env file placed on the trusted filesystem by the first primitive is then consumed by the under-restricted go vet process, escalating the sandbox escape into remote code execution on the host itself. The affected component is the standalone package CPE cpe:2.3:a:golang.org/x/playground, i.e. independent deployments of golang.org/x/playground; the shared hosted service at go.dev/play does not expose this path.
Know when Golang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network submission (PR:N) with no separate victim (UI:N); AC:H because it requires chaining a crafted txtar with a go env file hitting one specific vet path; sandbox-to-host escape is S:C with full RCE impact.
Primary rating from Vendor (Go).
CVSS VectorVendor: Go
Lifecycle Timeline
3DescriptionCVE.org
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME.
Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.
This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Executive ViewAI
Self-hosted and forked deployments of golang.org/x/playground are exposed to remote code execution on the underlying host, but the public go.dev/play service is not affected. This creates risk for engineering teams that run internal Go playground instances, where an attacker could potentially compromise the host and its secrets. A vendor-released patch, 0.0.0-20260924211604-6d73cff14c17, is available, and no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
WAGO PFC200 G2 PLC (firmware affected) allows privilege escalation through cookie manipulation. Users can modify cookie
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.p
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI proc
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) all
Exploit-DB