onyx --cves cve-2026-39817

CVE-2026-39817

MEDGo

score: <0.1
cvss: 5.9
epss: 0.2%
published: 2026-05-07
kev added: —
first seen: 2026-10-21

Go tool pack subcommand contains an unrestricted file write vulnerability caused by unsanitized output filenames, letting attackers write files to arbitrary filesystem locations, exploit requires crafted malicious archive.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2026-05-07 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-787

References 4

https://go.dev/issue/78778
https://groups.google.com/g/golang-announce/c/qcCIEXso47M
https://pkg.go.dev/vuln/GO-2026-4979
https://go.dev/cl/767520