skillshare v0.26.2 Release Notes
TL;DR
- Security fix: releases are now built with Go 1.26.10 (CVE-2026-111943). Go 1.26.10 rejects certificate chains that pass through a set of compromised eMudhra intermediate CAs. Earlier releases were built with Go 1.25, which has no such fix.
skillshare upgradeFixed: HTTPS requests could trust a certificate forged through compromised CAs
Several eMudhra intermediate CA certificates were revoked for key compromise. Whoever holds a compromised key can issue a valid-looking certificate for any domain, such as github.com, to a person who can intercept your network connection. Go 1.26.10 and 1.27.3 make crypto/x509 reject any chain that passes through these intermediates. The Go team backported the fix to 1.26 and 1.27 only, so Go 1.25 never receives it.
skillshare releases up to v0.26.1 were built with Go 1.25.5. This release is built with Go 1.26.10, so the CLI now refuses those chains. It covers the HTTPS requests skillshare makes itself:
skillshare upgrade, which downloads a new binary- update checks and
skillshare search - npm registry lookups for plugins
The attack needs a position on your network path, such as a shared Wi-Fi network or a compromised router. skillshare upgrade is run by your current binary, which is still built with Go 1.25 until you finish upgrading, so run it on a network you trust.
Changed: building from source uses Go 1.26.10
go.mod, mise.toml and the Docker images now use Go 1.26.10. If you build skillshare yourself, use Go 1.26.10 or later. With an older Go, the go command downloads the newer toolchain unless GOTOOLCHAIN=local is set, in which case the build fails.
Reference: golang/go#82345, #604.