Is CVE-2026-119298 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119298 being exploited in the wild.

How severe is CVE-2026-119298?

Medium severity, with a CVSS score of 4.2, published 30 October 2026.

Which products and versions are affected?

github.com/schollz/croc (Go) <= 3.0.6, SEMVER:introduced=0,last_affected=3.0.6; github.com/schollz/croc/v10 (Go) <= 10.7.0, SEMVER:introduced=0,last_affected=10.7.0; github.com/schollz/croc/v11 (Go) < 11.5.2, SEMVER:introduced=0,fixed=11.5.2; github.com/schollz/croc/v6 (Go) <= 6.4.11, SEMVER:introduced=0,last_affected=6.4.11; and 3 more.

Is there a fix for CVE-2026-119298?

Yes. github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119298 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119298?

Check whether you run github.com/schollz/croc (Go), github.com/schollz/croc/v10 (Go), github.com/schollz/croc/v11 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119298: croc file overwrite vulnerability in text-transfer handling

Q: Is there a fix for CVE-2026-119298?

Yes. github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119298 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-119298?

Check whether you run github.com/schollz/croc (Go), github.com/schollz/croc/v10 (Go), github.com/schollz/croc/v11 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119298 · Severity: medium · CVSS 4.2 · Published 2026-10-30

croc is a secure file-transfer tool that allows users to exchange files between computers. Prior to version 11.5.2, a remote attacker could overwrite or truncate files on the receiving end by exploiting predictable naming patterns in the transfer protocol, bypassing user confirmation. An attacker who initiates a file transfer that the user accepts can manipulate files in the receiver's working directory without explicit approval.

Technologies: github.com/schollz/croc (Go), github.com/schollz/croc/v6 (Go), github.com/schollz/croc/v8 (Go), github.com/schollz/croc/v9 (Go). Vendors: Go.

Quick answers

Is CVE-2026-119298 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119298 being exploited in the wild.
How severe is CVE-2026-119298?: Medium severity, with a CVSS score of 4.2, published 30 October 2026.
Which products and versions are affected?: github.com/schollz/croc (Go) <= 3.0.6, SEMVER:introduced=0,last_affected=3.0.6; github.com/schollz/croc/v10 (Go) <= 10.7.0, SEMVER:introduced=0,last_affected=10.7.0; github.com/schollz/croc/v11 (Go) < 11.5.2, SEMVER:introduced=0,fixed=11.5.2; github.com/schollz/croc/v6 (Go) <= 6.4.11, SEMVER:introduced=0,last_affected=6.4.11; and 3 more.
Is there a fix for CVE-2026-119298?: Yes. github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119298 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119298?: Check whether you run github.com/schollz/croc (Go), github.com/schollz/croc/v10 (Go), github.com/schollz/croc/v11 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/schollz/croc/v11 (Go): upgrade to 11.5.2 or later
```
go get github.com/schollz/croc/v11@v11.5.2
```

Technical details

The vulnerability exists in the receive-side file-readiness loop in src/croc/croc.go, where sender-controlled basenames beginning with "croc-stdin-" are treated as trusted text-transfer artifacts regardless of the SendingText flag value. This allows an attacker to skip the askReceiveOverwrite confirmation prompt and rename handling, enabling file overwrite via recipientInitializeFile or file replacement via createEmptyFileAndFinish for predictable collisions in the receiver's working directory.

Affected products

schollz croc before 11.5.2

Identifiers

CVE-2026-119298
GHSA-x89h-7h96-v88f

Timeline

2026-10-30: disclosed
2026-09-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.