Is CVE-2026-39817 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39817 being exploited in the wild.

How severe is CVE-2026-39817?

Medium severity, with a CVSS score of 5.9, published 7 May 2026.

Which products and versions are affected?

toolchain (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.

Is there a fix for CVE-2026-39817?

Yes. toolchain (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39817 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-39817?

Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39817: Google Go arbitrary file write in go tool pack

CVE-2026-39817 · Severity: medium · CVSS 5.9 · Published 2026-05-07

A vulnerability in the Go programming language's 'pack' tool could allow a malicious archive to write files to unintended locations on a computer. This tool is typically used internally by the Go compiler, but if a user is tricked into manually extracting a specially crafted archive, it could overwrite sensitive system or application files. This could lead to unauthorized system changes or a compromise of the development environment.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-39817 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39817 being exploited in the wild.
How severe is CVE-2026-39817?: Medium severity, with a CVSS score of 5.9, published 7 May 2026.
Which products and versions are affected?: toolchain (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.
Is there a fix for CVE-2026-39817?: Yes. toolchain (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39817 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-39817?: Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.26.3 or later
```
go get toolchain@v1.26.3
```

Technical details

A path traversal vulnerability exists in the 'go tool pack' subcommand, which serves as a minimal version of the Unix 'ar' utility. The tool fails to sanitize output filenames during extraction, allowing an attacker to provide a malicious archive that writes files to arbitrary locations on the filesystem. While primarily used as an internal compiler tool with trusted inputs, manual invocation on untrusted archives poses a risk. The vulnerability is addressed by modifying 'pack' to refuse extraction of files containing directory components. Patches are available in Go versions 1.25.10 and 1.26.3.

Affected products

Google Go < 1.25.10, >= 1.26.0 < 1.26.3

Identifiers

CVE-2026-39817
GO-2026-4979

Timeline

2026-04-15: disclosed: Issue opened on Go GitHub repository
2026-05-07: advisory: NVD and Go Project published advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.