Vulnerability in Go Playground by Google: Potential Remote Code Execution

CVE-2026-94445

What is CVE-2026-94445?

A vulnerability in Go Playground allows a malicious txtar to escape its intended execution context, enabling arbitrary writes to the trusted filesystem of the playground host. This issue arises due to inadequate restrictions on one of the paths used to invoke go vet, which could lead to a Go process reading sensitive environment configuration files. By crafting a specific go env file and invoking go vet, an attacker could potentially execute arbitrary code on the playground host itself. While this vulnerability does not directly impact users of go.dev/play, it poses risks for independent deployments of the playground.

References