CVE-2026-94445

Name of the Vulnerable Software and Affected Versions golang.org/x/playground (affected versions not specified)

Description A malicious txtar archive can escape its execution context to force arbitrary writes to the trusted filesystem of the playground host. Additionally, a specific path used to invoke go vet fails to properly restrict the execution environment, allowing a Go process to read an environment configuration file located in the playground host's $HOME directory. The combination of a specially crafted go env file and the go vet invocation can result in remote code execution on the playground host. This issue specifically impacts independent deployments of the software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.