Vulnerability Description
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-91784?
CVE-2026-91784 is a documented vulnerability. cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process ...
How severe is CVE-2026-91784?
CVSS scoring is not yet available for CVE-2026-91784. Check NVD for updates.
Is there a patch for CVE-2026-91784?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.