PT-2026-39434 · Go · Github.Com/Tinfoil-Factory/Netfoil

Published 2026-04-29 · Updated 2026-04-29

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

The optional flag --filter-system-calls was not applied even if specified.

Details

This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd.

Impact

Reduced sandboxing of the netfoil binary.

Fix

Weakness Enumeration

CWE-791

Related Identifiers

GHSA-VJGJ-42F6-7997

Affected Products

Github.Com/Tinfoil-Factory/Netfoil

References · 5

• https://osv.dev/vulnerability/GHSA-vjgj-42f6-7997 · Vendor Advisory
• https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-vjgj-42f6-7997 · Note
• https://github.com/tinfoil-factory/netfoil · Note
• https://github.com/tinfoil-factory/netfoil/commit/8c84f1b03adf1df5b4e6d07a49043d13dbbf9ee1 · Note
• https://github.com/tinfoil-factory/netfoil/releases/tag/v0.2.1 · Note