https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:01:51 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-94445 <p>A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host&#39;s trusted filesystem.</p> <p>Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host&#39;s $HOME.</p> <p>Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.</p> <p>This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.</p> <p>A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host&#39;s trusted filesystem.</p> <p>Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host&#39;s $HOME.</p> <p>Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.</p> <p>This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-94445 https://vulnerability.circl.lu/vuln/ghsa-f83q-fx9f-w4gg <p>A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host&#39;s trusted filesystem.</p> <p>Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host&#39;s $HOME.</p> <p>Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.</p> <p>This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.</p> <p>A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host&#39;s trusted filesystem.</p> <p>Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host&#39;s $HOME.</p> <p>Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.</p> <p>This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.</p> https://vulnerability.circl.lu/vuln/ghsa-f83q-fx9f-w4gg