Executive brief
The 'go bug' command, a tool used by developers to report issues in the Go programming language, uses predictable filenames when creating temporary files. A malicious actor with access to the same system could use this flaw to trick the tool into overwriting sensitive system or user files. This could lead to data loss or system instability if critical configuration files are targeted.
Technical details
A symlink following vulnerability (CWE-59) exists in the 'go bug' command within the Go toolchain. The command writes to two files with predictable names in the system's temporary directory (e.g., /tmp). A local attacker can pre-create these files as symbolic links pointing to a target file they wish to overwrite. When a user runs 'go bug', the command follows the symlink and overwrites the target file with the bug report data. The issue is mitigated in newer versions by using os.MkdirTemp to create a secure, randomly named working directory.
Affected products
- Google Go < 1.25.10, >= 1.26.0 < 1.26.3
Timeline
- 2026-04-08: disclosed: Issue opened on Go GitHub repository
- 2026-05-07: advisory: NVD and Go project published advisory
- 2026-05-07: patched: Fix released in Go 1.25.10 and 1.26.3