CVE-2026-91784
— UNSCOREDpublic exploit availablePublished 2026-10-02 · Updated 2026-10-02
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.
Weaknesses
CWE-88
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100369PoC
- HIGHCVE-2026-100561PoC
- HIGHCVE-2026-100570PoC
- CRITICALCVE-2026-100714PoC
- HIGHCVE-2026-102827PoC
- MEDIUMCVE-2026-102904PoC
- MEDIUMCVE-2026-103505PoC
- HIGHCVE-2026-104715
Related by shared AI tags and CWE weakness class. Browse the full archive.