cmd/cgo

4 results · Feed

• Unscored —
  CVE-2026-97042

  Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link

  Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_…

  Go toolchain cmd/compile cmd/cgo cmd/link Debian Go
  Nov 11, 2026
• High 8.6
  CVE-2025-61732

  Potential code smuggling via doc comments in cmd/cgo

  A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

  Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• Critical 9.8
  CVE-2023-29405

  Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

  The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …

  Go toolchain cmd/go cmd/cgo katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 8, 2023
• Unscored —
  CVE-2020-28366

  Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

  Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

  Go toolchain cmd/go cmd/cgo go Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020