Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-94445— Malicious user input may lead to RCE in golang.org/x/playground

Quick assessment

Affected
golang.org/x/playground golang.org/x/playground
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

恶意的 txtar 文件可能突破预期的执行上下文限制，强制向沙盒主机（playground host）的可信文件系统执行任意写入操作。 此外，三种可能触发 命令的执行路径中，有一项未正确限制执行环境。这使得 Go 进程能够读取位于沙盒主机 目录下的环境配置文件。 结合精心构造的 配置文件与 命令的调用，可能导致在沙盒主机上发生远程代码执行（RCE）。 此漏洞不影响直接使用 go.dev/play 的用户；但可能会影响独立部署的 实例。

AI Predicted 9.1 Difficulty: Moderate EPSS 0.36% · P29

Affected Version Matrix 1

VendorProduct Version RangeStatus
golang.org/x/playground golang.org/x/playground < 0.0.0-20260924211604-6d73cff14c17 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94445

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Malicious user input may lead to RCE in golang.org/x/playground
Source: CVE Program / CVE List V5
Vulnerability Description
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself. This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
golang.org/x/playground golang.org/x/playground 0 ~ 0.0.0-20260924211604-6d73cff14c17 -

II. Public POCs for CVE-2026-94445

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94445

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-94445 (1)

Other References for CVE-2026-94445 (1)

IV. Related Vulnerabilities

Same weakness: CWE-20