---
id: GHSA-7856-g3gv-9wq8
title: 'netfoil: Attacker controlled data written to logs'
summary: 'netfoil: Attacker controlled data written to logs'
severity: low
cwe:
  - CWE-117
vendor: tinfoil-factory
product: github.com/tinfoil-factory/netfoil
ecosystem: go
affected:
  - github.com/tinfoil-factory/netfoil < 0.3.0
patched:
  - github.com/tinfoil-factory/netfoil 0.3.0
published: '2026-07-07'
updated: '2026-07-07'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7856-g3gv-9wq8'
references:
  - url: >-
      https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-7856-g3gv-9wq8
  - url: 'https://github.com/advisories/GHSA-7856-g3gv-9wq8'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-07T20:43:04.986Z'
---

## Overview

### Summary
Domain names were written to the log without first being validated to contain allowed characters.

### Impact
Depends on how the logs were used.

## Affected packages

- `github.com/tinfoil-factory/netfoil < 0.3.0`

## Remediation

Upgrade to a patched release:

- `github.com/tinfoil-factory/netfoil 0.3.0`