GitHub Advisoryadvisory · Go

GHSA-7856-g3gv-9wq8 netfoil: Attacker controlled data written to logs

LOW Published 2026-07-07 Modified 2026-07-07 Official page ↗

Ecosystem: Go
Packages: github.com/tinfoil-factory/netfoil
Severity: Low
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-117
Reviewed: 2026-07-07

Affected packages

• Go github.com/tinfoil-factory/netfoil: < 0.3.0 → fixed in 0.3.0

Description

Summary Domain names were written to the log without first being validated to contain allowed characters. Impact Depends on how the logs were used.

Related

Weakness · CWE (1)

CWE-117 Improper Output Neutralization for Logs weakness

References