CVE-2026-39819
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
- Published May 7, 2026
- CVSS 5.3 medium
- 0.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available