Skip to content
OpenAdvisories

Package · Go

toolchain

45 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-39817

    Invoking "go tool pack" does not sanitize output paths in cmd/go

    The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

    Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go
  • Medium 5.3
    CVE-2026-39819

    Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

    The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

    Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go
  • Medium 6.4
    CVE-2024-24787 Public exploit

    Arbitrary code execution during build on Darwin in cmd/go

    On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

    Go toolchain cmd/go toolchain Go
  • Medium 6.8
    CVE-2018-16874

    Directory traversal via "go get" command in cmd/go

    In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable…

    [UNKNOWN] golang golang-1.8 golang-1.10 Ubuntu Go