What’s Vulnerable › Vulnerabilities

CVE-2026-91784: Argument Injection leading to arbitrary process termination in gotop

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-02 · updated 2026-10-02
• Weakness: CWE-88

Description

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

Affected products

• cjbassi gotop: 3.0.0

References

• https://cert.pl/en/posts/2026/10/CVE-2026-91784
• https://github.com/cjbassi/gotop

Get alerted when CVE-2026-91784 or the next vulnerability affects your stack