The vulnerability allows an attacker to construct a malicious txtar that escapes the sandboxed execution environment of golang.org/x/playground, enabling arbitrary file writes on the playground host’s trusted filesystem. Additionally, one of three paths that can invoke the host’s go vet tool fails to constrain the environment, permitting a Go process to read an environment configuration file located in the host’s $HOME directory. When a crafted go environment file is combined with the vulnerable go vet invocation, the attacker can achieve remote code execution on the playground host. The weakness is a classic Input Validation flaw (CWE‑20).

The affected product is golang.org/x/playground, specifically deployments of the playground component that run independently from the official go.dev/play service. No specific version range is listed in the data; users should verify that their instance includes the patch referenced in go.dev/issue/81737.

The CVSS score of 8.8 indicates a high severity vulnerability. Although the EPSS score is not available, the absence of a KEV listing does not diminish the risk; the exploit pathway is publicly described and requires only skills to supply a malicious txtar or manipulate the go vet invocation. If an attacker can send such input to an exposed playground instance, they have a viable attack vector to compromise the host system.