{"id":"GHSA-7856-g3gv-9wq8","title":"netfoil: Attacker controlled data written to logs","summary":"netfoil: Attacker controlled data written to logs","severity":"low","cwe":["CWE-117"],"vendor":"tinfoil-factory","product":"github.com/tinfoil-factory/netfoil","ecosystem":"go","affected":["github.com/tinfoil-factory/netfoil < 0.3.0"],"patched":["github.com/tinfoil-factory/netfoil 0.3.0"],"published":"2026-07-07","updated":"2026-07-07","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7856-g3gv-9wq8","references":[{"url":"https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-7856-g3gv-9wq8"},{"url":"https://github.com/advisories/GHSA-7856-g3gv-9wq8"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-07T20:43:04.986Z","slug":"GHSA-7856-g3gv-9wq8","body":"## Overview\n\n### Summary\nDomain names were written to the log without first being validated to contain allowed characters.\n\n### Impact\nDepends on how the logs were used.\n\n## Affected packages\n\n- `github.com/tinfoil-factory/netfoil < 0.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/tinfoil-factory/netfoil 0.3.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}