Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 18, 2026 · NIST NVD

   Detected

   Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the function in (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the check. A crafted tar archive can write files outside the intended destination directory.

2. Jun 17, 2026 · NIST NVD

   Updated

   Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the function in (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the check. A crafted tar archive can write files outside the intended destination directory.

Affected

• cpe ctfer-io/romeoversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-32805

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32805

  Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the function in (lines 80-88) is vul

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com