The go bug command in the Go toolchain constructs two temporary files with predictable names in the system temporary directory, such as /tmp. If an attacker can write to this directory, they can create a symbolic link pointing to an arbitrary target and then run go bug. The command will follow the symlink and overwrite the file it references. This local file overwrite is consistent with CWE-59.

This vulnerability exists in the Go toolchain, specifically the cmd/go command "go bug". No specific Go version numbers are provided in the advisory, so all current releases that have not been patched are potentially affected. The issue can arise on any platform where the system temporary directory (e.g., /tmp on Unix-like systems) is writable by the user executing go bug. A local attacker with write access to that directory can exploit the flaw.

The flaw is local; it requires write access to the system temporary directory, a permission that many users are granted. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to influence the temporary directory used by go bug; the likely attack vector is a local user with write access to that directory.