Skip to content
OpenAdvisories

Vendor

Go toolchain

37 known vulnerabilities.

Products

cmd/go 32 cmd/compile 5 cmd/cgo 4 cmd/link 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-39817

    Invoking "go tool pack" does not sanitize output paths in cmd/go

    The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

    Go toolchain cmd/go renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-39819

    Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

    The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

    Go toolchain cmd/go renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.4
    CVE-2024-24787 Public exploit

    Arbitrary code execution during build on Darwin in cmd/go

    On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

    Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Azure Linux Wolfi Go