Vulnerability · Published Oct 2, 2026 · Assigned by CERT-PL

CVE-2026-91784Argument Injection leading to arbitrary process termination in gotop

Medium 4.8

In plain English

A medium-severity argument injection in gotop from cjbassi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

Affected products (as reported)

Vendor	Product	Versions
cjbassi	gotop	3.0.0

Weakness: CWE-88 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/10/CVE-2026-91784 third-party-advisory
https://github.com/cjbassi/gotop product