The vulnerability in cjbassi/gotop version 3.0.0 involves improper neutralization of argument delimiters (CWE-88) in the process termination functionality. Specifically, the process name is passed directly to the pkill command without sanitization. A local attacker can create a process with a name beginning with '--' (e.g., including a target user's UID). When the kill feature is invoked on this process, pkill misinterprets the crafted name as an option rather than a process name, leading to termination of all processes owned by the targeted user. The product is no longer maintained and no fix is available.

A local attacker can exploit this vulnerability to terminate all processes owned by a targeted user by crafting a malicious process name. This can cause denial of service for the targeted user's processes. The vulnerability requires local access and user interaction to invoke the kill feature in gotop. The CVSS 4.0 base score is 4.8 (medium severity), reflecting limited attack vector and privileges required.

No official fix or patch is available as the product is no longer actively supported. Users should avoid running gotop version 3.0.0 or later versions that may be affected. Consider using alternative tools that properly sanitize input to pkill or avoid using the kill feature on untrusted process names.