The vulnerability involves the "go bug" command in the Go toolchain writing to two files with predictable names in the system temporary directory (e.g., /tmp). Because these filenames are predictable, an attacker who can write to the temporary directory can create symbolic links with those names. When "go bug" runs, it follows the symlink and overwrites the linked target file, potentially leading to unauthorized file overwrite and integrity compromise. This issue is categorized under CWE-377: Insecure Temporary File.

An attacker with access to the system's temporary directory can exploit this vulnerability to overwrite arbitrary files by creating symbolic links with predictable temporary filenames. This can lead to unauthorized modification of files, potentially affecting system integrity or causing denial of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to the system temporary directory to trusted users only to prevent unauthorized creation of symbolic links. Avoid running the "go bug" command in untrusted environments or with elevated privileges.