The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade rclone | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-sharedUpgrade golang-testsUpgrade golang-srcUpgrade golang-binUpgrade golang-miscUpgrade golang | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade golang-sharedUpgrade golang-binUpgrade golang-docs | May 28, 2026 | May 7, 2026 |
| Oracle_linux | — | Upgrade golang-raceUpgrade go-toolsetUpgrade golang-miscUpgrade golangUpgrade delveUpgrade golang-docsUpgrade golang-testsUpgrade golang-srcUpgrade golang-bin | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-raceUpgrade delve-debugsourceUpgrade golang-testsUpgrade delveUpgrade go-toolsetUpgrade delve-debuginfoUpgrade golang-docsUpgrade golang-srcUpgrade golangUpgrade golang-bin | Aug 27, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade delve-debuginfoUpgrade golang-raceUpgrade go-toolsetUpgrade delveUpgrade golang-binUpgrade golangUpgrade delve-debugsource | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub