The "go bug" command wrote to two files with predictable names in
the system temporary directory (for example, "/tmp").

An attacker with access to the temporary directory could create a
symlink in one of these names, causing "go bug" to overwrite the
target of the symlink.

The "go bug" command now uses os.MkdirTemp to create a safe
working directory.

Thanks to Harshit Gupta (Mr HAX) for reporting this issue.

This is CVE-2026-39819 and Go issue https://go.dev/issue/78584.

This was a PUBLIC track issue, tracked in http://b/499330546.