The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade rclone | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-binUpgrade golang-docsUpgrade golang-shared | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-binUpgrade golang-docsUpgrade golang-srcUpgrade golang-miscUpgrade golangUpgrade golang-tests | May 28, 2026 | May 7, 2026 |
| Oracle_linux | — | Upgrade golang-miscUpgrade golang-raceUpgrade go-toolsetUpgrade golang-binUpgrade golangUpgrade golang-testsUpgrade golang-srcUpgrade golang-docsUpgrade delve | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade golang-docsUpgrade delve-debuginfoUpgrade go-toolsetUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade delve-debugsourceUpgrade golang-testsUpgrade golang-miscUpgrade delveUpgrade golang-race | Aug 27, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade go-toolsetUpgrade delve-debuginfoUpgrade delveUpgrade golang-raceUpgrade golang-binUpgrade golangUpgrade delve-debugsource | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub