netfoil's optional seccomp sandboxing was not applied

published 2026-04-29 6mo ago modified 2026-06-25 4mo ago also GO-2026-5664

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary The optional flag `--filter-system-calls` was not applied even if specified.

### Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd.

### Impact Reduced sandboxing of the netfoil binary.

Patch / fix

fixed in 1 links 2

go github.com/tinfoil-factory/netfoil 0.2.1

Is GHSA-vjgj-42f6-7997 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/tinfoil-factory/netfoil	<0.2.1	0.2.1

Classification

Weakness

CWE-791 Incomplete Filtering of Special Elements

References

Sources

GitHub Advisory GHSA-vjgj-42f6-7997
OSV GO-2026-5664

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.