Internal Syscall Windows
Monthly
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).