—
GO-2026-4978
Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
Quick fix
GO-2026-4978 — toolchain: upgrade to the fixed version with the command below.
go get toolchain@v1.25.10Details
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").
An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Are you affected?
Enter the version of the package you're using.