Vulnerability in gotop software

CERT Polska has received a report about vulnerability in cjbassi/gotop software and participated in coordination of its disclosure.

The vulnerabilityCVE-2026-91784: cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly topkillwithout sanitization. A local attacker can create a process with a crafted name beginning with--(e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process,pkillinterprets the crafted name as a command-line option, terminating all processes owned by the targeted user.

Product is no longer actively supported and the vulnerability has not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

We thank Michał Majchrowicz and Marcin Wyczechowski from AFINE Team for the responsible vulnerability report.