CVE-2026-91784

Summary

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with – (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user.

Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

Affected Software

Weaknesses

• CWE-88: CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://cert.pl/en/posts/2026/10/CVE-2026-91784
• https://github.com/cjbassi/gotop

• ←Previous
• Next→