CVE-2026-94445

Summary

The flaw allows a malicious txtar to escape the intended execution context and perform arbitrary writes, potentially leading to remote code execution.

Exploitability

Exploitation requires a malicious txtar and the ability to invoke go vet with specific environment configurations. The exploit is moderately complex.

Blast radius

If exploited, this could lead to remote code execution on the playground host, impacting independent deployments of golang.org/x/playground.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the go vet invocation endpoint.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.