Junglewise Threat Intelligence

CVE-2026-33623: GO-2026-4823 - PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pincht

CVE-2026-33623 · Severity: low · CVSS 3.1 · Published 2026-03-26

Technologies: github.com/pinchtab/pinchtab (Go), github.com/pinchtab/pinchtab/cmd/pinchtab (Go). Vendors: Go.

Executive brief

PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab

Affected products

  • Go github.com/pinchtab/pinchtab
  • Go github.com/pinchtab/pinchtab/cmd/pinchtab

Related threats