GHSA-7856-g3gv-9wq8
netfoil: Attacker controlled data written to logs
GHSA-7856-g3gv-9wq8 is a low vulnerability (CVSS 2.3) in github.com/tinfoil-factory/netfoil, published July 7, 2026. No source lists public exploit code. Fixed in github.com/tinfoil-factory/netfoil 0.3.0.
- Severity
- 2.3 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.0github.com/tinfoil-factory/netfoil
Description
Summary
Domain names were written to the log without first being validated to contain allowed characters.
Impact
Depends on how the logs were used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/tinfoil-factory/netfoilGo | before 0.3.0 | 0.3.0 |
What each source reports
GitHub Advisories Score used
netfoil: Attacker controlled data written to logs
Summary
Domain names were written to the log without first being validated to contain allowed characters.
Impact
Depends on how the logs were used.
- Record
GHSA-7856-g3gv-9wq8- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-117
- Updated
- 2026-11-02
OSV
netfoil: Attacker controlled data written to logs
Summary
Domain names were written to the log without first being validated to contain allowed characters.
Impact
Depends on how the logs were used.
- Record
GHSA-7856-g3gv-9wq8- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-117
- Updated
- 2026-11-02
OSVGO-2026-5935No score
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
- Record
GO-2026-5935- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.