[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-39822":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":25,"duplicate_of":9,"upstream":28,"downstream":29,"duplicates":84,"related":85,"reserved_at":9,"published_at":112,"modified_at":113,"state":114,"summary":115,"references_raw":122,"kevs":143,"epss":9,"epss_history":144,"metrics":145,"affected":151},"CVE-2026-39822","On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-61","UNIX Symbolic Link (Symlink) Following","The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.","weakness","Incomplete","Compound","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-27","Leveraging Race Conditions via Symbolic Links",[],[],[26,27],"GO-2026-4970","BIT-golang-2026-39822",[],[30,32,34,36,38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82],{"_key":31},"SUSE-SU-2026:2817-1",{"_key":33},"SUSE-SU-2026:2818-1",{"_key":35},"OPENSUSE-SU-2026:11212-1",{"_key":37},"OPENSUSE-SU-2026:11232-1",{"_key":39},"MGASA-2026-0276",{"_key":41},"SUSE-SU-2026:22638-1",{"_key":43},"SUSE-SU-2026:22641-1",{"_key":45},"SUSE-SU-2026:22643-1",{"_key":47},"SUSE-SU-2026:22656-1",{"_key":49},"SUSE-SU-2026:3046-1",{"_key":51},"SUSE-SU-2026:3047-1",{"_key":53},"SUSE-SU-2026:3102-1",{"_key":55},"RHSA-2026:36477",{"_key":57},"RHSA-2026:36510",{"_key":59},"RHSA-2026:37435",{"_key":61},"RHSA-2026:37436",{"_key":63},"RHSA-2026:38493",{"_key":65},"RHSA-2026:38494",{"_key":67},"RHSA-2026:38495",{"_key":69},"RHSA-2026:38878",{"_key":71},"RHSA-2026:38995",{"_key":73},"UBUNTU-CVE-2026-39822",{"_key":75},"DEBIAN-CVE-2026-39822",{"_key":77},"OPENSUSE-SU-2026:21319-1",{"_key":79},"OPENSUSE-SU-2026:21321-1",{"_key":81},"OPENSUSE-SU-2026:21324-1",{"_key":83},"OPENSUSE-SU-2026:21341-1",[],[86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110],{"_key":31},{"_key":33},{"_key":35},{"_key":37},{"_key":41},{"_key":43},{"_key":45},{"_key":47},{"_key":49},{"_key":51},{"_key":53},{"_key":55},{"_key":57},{"_key":59},{"_key":61},{"_key":63},{"_key":65},{"_key":67},{"_key":69},{"_key":71},{"_key":77},{"_key":79},{"_key":81},{"_key":83},{"_key":111},"CGA-8R5H-83C2-4RXW","2026-07-08T15:46:27.199Z","2026-07-08T19:39:17.341Z","PUBLISHED",{"cisa_kev":116,"cisa_ransomware":116,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":117,"severity_score":118,"severity_version":119,"severity_source":120,"severity_vector":121,"severity_status":114},false,"high",7.8,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[123,129,134,139],{"url":124,"sources":125,"tags":127},"https://go.dev/issue/79005",[120,126],"osv_go",[128],"REPORT",{"url":130,"sources":131,"tags":132},"https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",[120,126],[133],"WEB",{"url":135,"sources":136,"tags":137},"https://go.dev/cl/797880",[120,126],[138],"FIX",{"url":140,"sources":141,"tags":142},"https://pkg.go.dev/vuln/GO-2026-4970",[120],[],[],[],[146],{"source":120,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":147,"cvss_v4_0":9},{"baseScore":118,"baseSeverity":148,"vectorString":121,"impactScore":149,"exploitabilityScore":150},"HIGH",9.8,4.6,[152,171],{"ecosystem":9,"name":153,"vendor":154,"product":153,"cpe_part":155,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":156},"os","go standard library","a",[157,162,167],{"version":158,"is_range":159,"range_type":120,"version_start":9,"version_start_type":9,"version_end":160,"version_end_type":161,"fixed_in":9},"\u003C 1.25.12",true,"1.25.12","excluding",{"version":163,"is_range":159,"range_type":120,"version_start":164,"version_start_type":165,"version_end":166,"version_end_type":161,"fixed_in":9},">= 1.26.0-0, \u003C 1.26.5","1.26.0-0","including","1.26.5",{"version":168,"is_range":159,"range_type":120,"version_start":169,"version_start_type":165,"version_end":170,"version_end_type":161,"fixed_in":9},">= 1.27.0-0, \u003C 1.27.0-rc.2","1.27.0-0","1.27.0-rc.2",{"ecosystem":172,"name":173,"vendor":172,"product":173,"cpe_part":9,"purl_type":174,"purl_namespace":9,"purl_name":173,"source":9,"versions":175},"Go","stdlib","golang",[176],{"version":177,"is_range":159,"range_type":178,"version_start":169,"version_start_type":165,"version_end":170,"version_end_type":161,"fixed_in":9},"gte1_27_0_0_lt1_27_0_rc_2","semver"]