CVE-2026-88046: Go Unix Shell Escape Without Shell Type
Using a Unix-only regex backslash escaping routine for shell command arguments fails to neutralize metacharacters when the command runs on Windows shells (such as PowerShell or cmd.exe). This can allow command or argument injection. Use shell-specific quoting and escaping based on the target shell environment.
Gogreprules fetch cve-2026-88046-go-unix-shell-escape-without-shell-type --engine opengrepDescription
Using a Unix-only regex backslash escaping routine for shell command arguments fails to neutralize metacharacters when the command runs on Windows shells (such as PowerShell or cmd.exe). This can allow command or argument injection. Use shell-specific quoting and escaping based on the target shell environment.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.