CVE-2026-94445

Awaiting Analysis Awaiting Analysis - Queue

File Write Vulnerability in Go Playground Host

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: Go Project

Description

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself. This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-94445

EUVD

EUVD-2026-87201

Affected Vendors & Products

Vendor	Product	Version / Range
golang	golang_playground	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious txtar file escaping its intended execution context to write to the playground host's trusted filesystem. Additionally, a misconfigured path for invoking go vet allowed a Go process to read an environment configuration file from the playground host's $HOME directory. Combined, these flaws could enable remote code execution on the playground host.

Detection Guidance

This vulnerability involves malicious txtar files or improper go env file handling in Go playground deployments. To detect it, inspect Go playground logs for unauthorized filesystem writes or go vet invocations with unusual paths. Check for files created outside intended directories, especially in $HOME or trusted filesystem areas.

Impact Analysis

If you run independent deployments of golang.org/x/playground, attackers could exploit this to execute arbitrary code on your system. Users of go.dev/play are not affected. The impact includes potential data breaches, system compromise, or unauthorized access to sensitive files.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be impacted if exploited, requiring incident response and potential regulatory reporting.

Mitigation Strategies

Update or patch the golang.org/x/playground package to the latest version to address the arbitrary write and environment file read issues. Disable or restrict access to independent deployments of golang.org/x/playground if not necessary. Monitor for suspicious filesystem writes or unexpected Go process behavior.

Hi! I’m here to help you understand CVE-2026-94445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70