CVE-2026-91784

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

• CWE-88

• https://cert.pl/en/posts/2026/10/CVE-2026-91784
• https://github.com/cjbassi/gotop

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91778In affected versions of Octopus Server, users with certain s…7.2
• CVE-2026-91779A security flaw has been discovered in GNU Binutils 2.47. Th…3.3
• CVE-2026-9178The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-91780A weakness has been identified in GNU Binutils 2.47. This im…3.3
• CVE-2026-91781A security vulnerability has been detected in GNU Binutils 2…3.3
• CVE-2026-91782A vulnerability was detected in GNU Binutils 2.47. Affected …3.3
• CVE-2026-91786A flaw was found in GNOME Shell. When processing icons from …6.1
• CVE-2026-91788When implementing the JavaScript interface, Foxit PDF Editor…5.5
• CVE-2026-91789Foxit PDF Editor/Reader’s U3D/GIF texture decoding path cont…7.8
• CVE-2026-9179The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-91790When rendering the page image, Foxit PDF Editor/Reader fails…7.8
• CVE-2026-91791When processing a specially crafted PDF file, Foxit PDF Edit…7.8