GitHub Advisoryadvisory · Go

GHSA-vjgj-42f6-7997 netfoil's optional seccomp sandboxing was not applied

MEDIUM Published 2026-04-29 Modified 2026-04-29 Official page ↗
Ecosystem
Go
Packages
github.com/tinfoil-factory/netfoil
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-791
Reviewed
2026-04-29

Affected packages

• Go github.com/tinfoil-factory/netfoil: < 0.2.1 → fixed in 0.2.1

Description

Summary The optional flag `--filter-system-calls` was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binary.

Related

Weakness · CWE (1)

  • CWE-791 Incomplete Filtering of Special Elements weakness

References