CVE-2026-91784

Name of the Vulnerable Software and Affected Versions cjbassi/gotop version 3.0.0

Description Local argument injection is possible through the process termination functionality. The software passes the process name directly to the pkill command without proper sanitization. A local attacker can create a process with a name starting with -- (for example, including a target user's UID). If a user running the application invokes the kill feature on this process, pkill treats the crafted name as a command-line option, resulting in the termination of all processes owned by the targeted user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.