# CVE-2026-39819: Google Go symlink attack in go bug command

Source: https://junglewise.ai/threats/cve-2026-39819-google-go-symlink-attack-in-go-bug-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-39819 · Severity: medium · CVSS 5.3 · Published 2026-05-07

The 'go bug' command, a tool used by developers to report issues in the Go programming language, uses predictable filenames when creating temporary files. A malicious actor with access to the same system could use this flaw to trick the tool into overwriting sensitive system or user files. This could lead to data loss or system instability if critical configuration files are targeted.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-39819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39819 being exploited in the wild.

**How severe is CVE-2026-39819?** Medium severity, with a CVSS score of 5.3, published 7 May 2026.

**Which products and versions are affected?** toolchain (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.

**Is there a fix for CVE-2026-39819?** Yes. toolchain (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39819 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-39819?** Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toolchain (Go): upgrade to 1.26.3 or later

  ```sh
  go get toolchain@v1.26.3
  ```


## Technical details

A symlink following vulnerability (CWE-59) exists in the 'go bug' command within the Go toolchain. The command writes to two files with predictable names in the system's temporary directory (e.g., /tmp). A local attacker can pre-create these files as symbolic links pointing to a target file they wish to overwrite. When a user runs 'go bug', the command follows the symlink and overwrites the target file with the bug report data. The issue is mitigated in newer versions by using os.MkdirTemp to create a secure, randomly named working directory.

## Affected products

- Google Go < 1.25.10, >= 1.26.0 < 1.26.3

## Identifiers

- CVE-2026-39819
- GO-2026-4978

## Timeline

- 2026-04-08: disclosed: Issue opened on Go GitHub repository
- 2026-05-07: advisory: NVD and Go project published advisory
- 2026-05-07: patched: Fix released in Go 1.25.10 and 1.26.3

## References

- [https://go.dev/cl/763882](https://go.dev/cl/763882)
- [https://go.dev/issue/78584](https://go.dev/issue/78584)
- [https://groups.google.com/g/golang-announce/c/qcCIEXso47M](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)
- [https://pkg.go.dev/vuln/GO-2026-4978](https://pkg.go.dev/vuln/GO-2026-4978)

## Related threats

- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)
- [Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives)