Code Injection

pkg is vulnerable toCode Injection. The vulnerability is due to the use of a hardcoded directory (/tmp/pkg/*) for native code packages, which is shared among all users on the same local system without unique or unpredictable package names, enabling attackers to replace genuine executables with malicious ones. Please note that the maintainers have deprecated the package, meaning no patch will be released for this issue.