---
id: "GO-2026-6893"
page: "https://infrastack.ai/live/GO-2026-6893"
kind: "vulnerability"
aliases: ["GO-2026-6893"]
title: "Event type spoofing via UntrustedType in github.com/google/go-eventlog"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/google/go-eventlog", "fixed": ["0.0.3-0.20261001001437-1991f15bc4b0"], "affected": "< 0.0.3-0.20261001001437-1991f15bc4b0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["attestation", "go", "go-eventlog", "package", "tpm"]
not_affected_if: ["does-not-import-tcg", "no-untrustedtype-dispatch"]
published_at: "2026-11-05T22:55:15+00:00"
first_seen_at: "2026-11-06T00:09:14+00:00"
updated_at: "2026-11-06T00:10:29+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6893", "first_seen_at": "2026-11-06T00:09:14+00:00"}]
exploit_sources: []
---

# Event type spoofing via UntrustedType in github.com/google/go-eventlog

Link for people: https://infrastack.ai/live/GO-2026-6893 (this .md is for agents)

In github.com/google/go-eventlog/tcg, the UntrustedType method returns the event type from the TCG event log without checking it against the event's digest. A caller that dispatches on that type after ParseAndReplay can be misled by a modified event type field.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/google/go-eventlog affected < 0.0.3-0.20261001001437-1991f15bc4b0 fixed 0.0.3-0.20261001001437-1991f15bc4b0

## How to check

- Search the Go code for `UntrustedType` and `ParseAndReplay` from `github.com/google/go-eventlog/tcg`.
- Check the module version in `go.mod` for `github.com/google/go-eventlog` against the fixed version below.

## Fix

- `github.com/google/go-eventlog` `0.0.3-0.20261001001437-1991f15bc4b0`

## Timeline

- 2026-11-06T00:09:14+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6893

## From the sources

In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_