CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground
Attackers can achieve remote code execution on independent Go playground deployments by exploiting path traversal and environment variable injection flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-94445?
CVE-2026-94445 is a high-severity code injection vulnerability in golang.org/x/playground, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME.
Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.
This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Weakness: CWE-20
Which versions are affected by CVE-2026-94445?
How do I fix CVE-2026-94445?
No fix has been published for CVE-2026-94445 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-94445 being exploited?
There is no known exploitation of CVE-2026-94445 in the wild and no public exploit code.
Sources
Also known as GHSA-f83q-fx9f-w4gg.