GHSA-vjgj-42f6-7997 netfoil's optional seccomp sandboxing was not applied
The netfoil binary fails to apply optional seccomp sandboxing filters, reducing defense-in-depth protections for users who enable this feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vjgj-42f6-7997?
GHSA-vjgj-42f6-7997 is a vulnerability in github.com/tinfoil-factory/netfoil, published on 29 Apr 2026.
Official description
Summary
The optional flag --filter-system-calls was not applied even if specified.
Details
This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd.
Impact
Reduced sandboxing of the netfoil binary.
Which versions are affected by GHSA-vjgj-42f6-7997?
3 open source packages ship an affected version, including github.com/tinfoil-factory/netfoil.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
github.com/tinfoil-factory/netfoil Go | All versions | 0.2.1 |
How do I fix GHSA-vjgj-42f6-7997?
Upgrade github.com/tinfoil-factory/netfoil to 0.2.1 or later.
Is GHSA-vjgj-42f6-7997 being exploited?
There is no known exploitation of GHSA-vjgj-42f6-7997 in the wild and no public exploit code.
Sources
Also known as GO-2026-5664.