Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME.
Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.
This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| golang.org/x/playground | golang.org/x/playground | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://go.dev/cl/838485 |
|
| https://go.dev/issue/81737 |
|
Fri, 25 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Fri, 25 Sep 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself. This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground. | |
| Title | Malicious user input may lead to RCE in golang.org/x/playground | |
| Weaknesses | CWE-20 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-09-25T17:08:14.767Z
Reserved: 2026-09-21T16:43:04.757Z
Link: CVE-2026-94445
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-25T17:17:19.963
Modified: 2026-09-25T18:17:33.730
Link: CVE-2026-94445
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-25T20:45:17Z
-
CWE-20
Improper Input Validation