CVE-2026-91784 in gotop
Summary
by MITRE • 10/02/2026
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user.
Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in cjbassi/gotop represents a critical local argument injection flaw within its process termination functionality, stemming from the unsafe handling of user-supplied input when interacting with system utilities. Specifically, the application passes the name of a selected process directly to the pkill command without performing any sanitization or validation checks on the string content. This architectural decision creates a direct path for an attacker who has local access to manipulate how external commands are executed by the privileged context in which gotop operates. The core technical flaw lies in the failure to distinguish between data and code, allowing maliciously crafted process names to be interpreted as command-line flags rather than literal search patterns.
In operational terms, this vulnerability allows a local attacker to execute arbitrary actions with elevated privileges depending on how pkill is invoked by the gotop application. By creating a new process whose name begins with double hyphens followed by specific options, such as arguments targeting user identifiers or other control flags, an attacker can trick the system into interpreting these strings as instructions for pkill rather than names to match against running processes. For instance, if an attacker creates a process named --user=1000, and a victim with higher privileges uses gotop to terminate that specific process, the underlying pkill utility will not look for a process literally named "--user=1000". Instead, it will interpret this as a request to kill all processes owned by user ID 1000. This results in a denial of service condition where legitimate applications belonging to the targeted user are abruptly terminated without their consent or knowledge.
The impact of this vulnerability extends beyond simple application crashes, potentially leading to significant data loss and system instability for the victim. Since pkill is often invoked with permissions that allow it to terminate processes owned by other users under certain configurations or if run as root, an attacker can escalate privileges effectively by causing a denial-of-service attack against critical services running on behalf of privileged accounts. This aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, where untrusted data influences the structure or execution of system commands. Furthermore, from a threat modeling perspective using MITRE ATT&CK frameworks, this behavior corresponds to techniques involving command and script interception or abuse of existing tools for lateral movement and disruption, specifically falling under T1053 Scheduled Task/Job or more broadly under privilege escalation vectors that exploit misconfigured permissions and lack of input validation.
Mitigation strategies must address both the immediate technical flaw and the broader security posture regarding legacy software management. The most effective remediation involves implementing strict input sanitization to ensure that process names passed to external commands are treated exclusively as literal strings, potentially by using argument delimiters such as -- to signal the end of options for pkill, thereby preventing any subsequent characters from being parsed as flags. Additionally, employing allowlists for allowed characters in process names or escaping special shell metacharacters can further reduce risk. However, given that cjbassi/gotop is no longer actively supported and these vulnerabilities have not been patched by the maintainers, reliance on this software poses an unacceptable security risk. Organizations should prioritize migrating to maintained alternatives that adhere to secure coding practices and regularly update their tooling inventory to eliminate exposure to known unpatched flaws in deprecated applications.