Vulnerability · Published Sep 25, 2026 · Assigned by Go
CVE-2026-94445Malicious user input may lead to RCE in golang.org/x/playground
High 8.8
In plain English
A high-severity improper input validation in golang.org/x/playground from golang.org/x/playground. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself. This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| golang.org/x/playground | golang.org/x/playground | 0 – before 0.0.0-20260924211604-6d73cff14c17 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H