Arbitrary Module Content Vulnerability in Go Mod Tool by Google

CVE-2026-56864

What is CVE-2026-56864?

A flaw in the Go Mod Tool allows a compromised GOSUMDB to deliver unauthorized module content that bypasses visibility in the transparency log. This vulnerability enables an attacker controlling both a GOPROXY and GOSUMDB to supply harmful modules to clients, potentially leading to undisclosed security risks. Users are advised to verify their installations by removing the go.sum and go.work.sum files and performing a go mod tidy operation to ensure the integrity of their dependencies.

References