Tinfoil Factory netfoil log injection via unvalidated domain names

Executive brief

The netfoil library, used for network-related operations in Go applications, fails to properly clean domain names before writing them to system logs. This could allow an attacker to inject misleading information or special characters into logs, potentially complicating incident investigations or affecting automated log-monitoring tools. The impact depends on how your organization processes and views these logs.

Technical details

A log injection vulnerability (CWE-117) exists in netfoil versions prior to 0.3.0. The library constructs log messages using external domain name input without neutralizing special characters or validating the input against allowed character sets. An attacker with network access and low privileges can provide crafted domain names that are subsequently written to the logs. This can be used to forge log entries or inject malicious content that may be interpreted by log management software. The issue is resolved in version 0.3.0.

Affected products

• tinfoil-factory netfoil < 0.3.0

Timeline

• 2026-05-31: disclosed: Initial report by stigtsp
• 2026-07-07: advisory: GitHub Advisory published
• 2026-07-07: patched: Version 0.3.0 released

References

• https://api.github.com/users/stigtsp
• https://github.com/stigtsp
• https://api.github.com/users/stigtsp/gists%7B/gist_id%7D
• https://api.github.com/users/stigtsp/repos
• https://avatars.githubusercontent.com/u/75371?v=4
• https://api.github.com/users/stigtsp/events%7B/privacy%7D