Symlink Vulnerability in Go Programming Language Temporary Files

CVE-2026-39819

What is CVE-2026-39819?

A security flaw in the Go programming language allows the 'go bug' command to write to two files with fixed names in the system's temporary directory. An attacker with access to this directory could exploit this behavior by creating a symbolic link (symlink) to a target file. This would result in the 'go bug' command unintentionally overwriting the content of the linked file, potentially leading to data loss or further exploitation. This vulnerability emphasizes the need for secure handling of temporary files and symlinks in applications.

References