CVE-2026-94445 Overview
CVE-2026-94445 affects the Go playground (golang.org/x/playground), a self-hostable sandbox for running Go code snippets. The vulnerability combines two distinct flaws: a malicious txtar archive can escape the intended execution context and force arbitrary writes onto the playground host's trusted filesystem, and one of three code paths that invoke go vet fails to restrict the execution environment. Chained together, a crafted go env configuration file and a go vet invocation enable remote code execution on the playground host. The hosted service at go.dev/play is not affected, but any independent deployment of golang.org/x/playground is.
Critical Impact
Unauthenticated attackers can achieve remote code execution on self-hosted Go playground instances by combining arbitrary file write with a misconfigured go vet execution path.
Affected Products
- golang.org/x/playground self-hosted deployments
- Instances exposing the playground HTTP interface to untrusted users
- Downstream distributions that embed the playground code
Discovery Timeline
- 2026-09-25 - CVE-2026-94445 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-94445
Vulnerability Analysis
The flaw is an input validation weakness ([CWE-20]) in the playground's handling of user-submitted code bundles. The playground accepts multi-file submissions encoded as txtar archives, which the server extracts into a working directory before compilation. A malicious archive can specify file paths that traverse outside the intended sandbox directory, writing attacker-controlled content to arbitrary locations on the host filesystem the playground process can access.
Separately, the playground supports three distinct code paths to invoke go vet on submitted code. One of those paths does not fully isolate the invoked Go toolchain. The toolchain honors a go env configuration file rooted at $HOME, allowing the vetted process to read attacker-influenced environment settings.
When combined, the attacker writes a crafted go env file into the playground user's $HOME using the txtar escape, then triggers the unrestricted go vet path. The toolchain loads the planted configuration, which can redirect toolchain components or inject commands that execute in the context of the playground service.
Root Cause
The root cause is twofold: insufficient path sanitization when extracting txtar archives, and inconsistent environment isolation across the three go vet invocation paths. The sandbox contract assumes extracted files remain inside a scratch directory and that the Go toolchain runs with a controlled environment, but neither invariant is enforced on the vulnerable path.
Attack Vector
Exploitation requires network access to the playground endpoint and a user action to submit the crafted payload, though in deployments that auto-execute submitted code the user interaction requirement is trivially satisfied. The attacker submits a txtar bundle that drops a malicious go env file into $HOME, then submits a follow-up request that routes execution through the unrestricted go vet code path. See the Go Development Change Log and the Go Development Issue Report for the upstream fix and technical discussion.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-94445
Indicators of Compromise
- Unexpected files written outside the playground's scratch or temporary directory, particularly within $HOME of the service account
- Presence of a go env configuration file (typically ~/.config/go/env) that was not deployed by administrators
- go vet invocations spawning child processes unrelated to Go toolchain binaries
- Outbound network connections from the playground host to attacker-controlled infrastructure
Detection Strategies
- Monitor filesystem writes by the playground process to paths outside the designated sandbox root
- Alert on modifications to ~/.config/go/env or any file under the service account's $HOME
- Compare process ancestry of go vet invocations against an allow-list of expected toolchain binaries
Monitoring Recommendations
- Enable audit logging for the playground service account and forward events to a centralized log store
- Track HTTP request bodies that contain txtar headers (-- filename --) with paths including .. traversal sequences
- Baseline normal child-process trees for the playground service and alert on deviations
How to Mitigate CVE-2026-94445
Immediate Actions Required
- Update golang.org/x/playground to the patched revision referenced in Go change list CL 838485
- Audit the playground host's filesystem for unauthorized files, especially under $HOME and ~/.config/go/
- Rotate any credentials, API keys, or signing material accessible to the playground service account
Patch Information
The upstream fix is tracked in Go issue 81737 with the code change in Gerrit CL 838485. Operators of self-hosted playground deployments should pull the latest golang.org/x/playground sources, rebuild the service container, and redeploy. The hosted go.dev/play service does not require operator action.
Workarounds
- Run the playground inside a restrictive container or microVM that treats $HOME as ephemeral and read-only where feasible
- Set GOENV=/dev/null or point GOENV at an immutable, administrator-owned file to neutralize planted go env configurations
- Restrict network access from the playground host so that successful code execution cannot reach internal services or the internet
- Require authentication in front of the playground endpoint to limit exposure to trusted users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
