Gotop
Monthly
Local argument injection in gotop 3.0.0 allows an attacker who already holds an account and shell on the same host to terminate every process owned by a targeted user, because the tool forwards an attacker-controlled process name directly to pkill and the name is parsed as a command-line option. Exploitation depends on the victim actively selecting the maliciously named process in gotop's process-kill feature (UI:R, local only), so the impact is confined to availability on shared multi-user systems. The project is no longer actively supported and CERT-PL reports the issue has not been fixed; no public exploit identified at time of analysis, and the independent assessment rates it low severity (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-88).
Local argument injection in gotop 3.0.0 allows an attacker who already holds an account and shell on the same host to terminate every process owned by a targeted user, because the tool forwards an attacker-controlled process name directly to pkill and the name is parsed as a command-line option. Exploitation depends on the victim actively selecting the maliciously named process in gotop's process-kill feature (UI:R, local only), so the impact is confined to availability on shared multi-user systems. The project is no longer actively supported and CERT-PL reports the issue has not been fixed; no public exploit identified at time of analysis, and the independent assessment rates it low severity (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-88).