Only the latest release receives security fixes.

Please do not open a public GitHub issue for security vulnerabilities.

Report security issues privately via GitHub's built-in mechanism:

1. Go to the Security tab of this repository.
2. Click "Report a vulnerability".
3. Fill in the details: affected versions, reproduction steps, and potential impact.

You will receive an acknowledgement within 72 hours and a resolution timeline within 7 days for critical issues.

• Arbitrary code execution via crafted .go-version files or default-packages entries
• Path traversal in archive extraction
• Binary substitution during gvm install or gvm upgrade (SHA-256 bypass)
• Credential or secret leakage in logs or error messages

• Issues in Go toolchains themselves (report to the Go team)
• Social engineering or phishing
• Vulnerabilities in systems that gvm does not control (e.g. go.dev infrastructure)