GHSA-7856-g3gv-9wq8

Source

https://github.com/advisories/GHSA-7856-g3gv-9wq8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7856-g3gv-9wq8/GHSA-7856-g3gv-9wq8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7856-g3gv-9wq8

Aliases

GO-2026-5935

Published

2026-07-07T20:04:22Z

Modified

2026-07-21T19:19:26Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

netfoil: Attacker controlled data written to logs

Details

Summary

Domain names were written to the log without first being validated to contain allowed characters.

Impact

Depends on how the logs were used.

Database specific

{
    "cwe_ids":  [
        "CWE-117"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-07T20:04:22Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/tinfoil-factory/netfoil

Package

Name: github.com/tinfoil-factory/netfoil; View open source insights on deps.dev
Purl: pkg:golang/github.com/tinfoil-factory/netfoil

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7856-g3gv-9wq8/GHSA-7856-g3gv-9wq8.json"