Golang Org X Playground
Monthly
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.