CVE-2026-56865 | High | 8.4 | 2026-08-13 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-… |
CVE-2026-56864 | High | 7.5 | 2026-08-13 | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY an… |
CVE-2026-42501 | High | 7.5 | 2026-05-07 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affec… |
CVE-2026-39819 | Medium | 5.3 | 2026-05-07 | The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the tempora… |
CVE-2026-39817 | Medium | 5.9 | 2026-05-07 | The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a m… |
CVE-2026-27144 | High | 7.1 | 2026-04-08 | The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct d… |
CVE-2026-27143 | Critical | 9.8 | 2026-04-08 | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing t… |
CVE-2026-27140 | High | 8.8 | 2026-04-08 | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. |
CVE-2025-61732 | High | 8.6 | 2026-02-05 | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. |
CVE-2025-68119 | High | 7.0 | 2026-01-28 | Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules f… |
CVE-2025-61731 | High | 7.8 | 2026-01-28 | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config… |
CVE-2025-4674 | High | 8.6 | 2025-07-29 | The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present i… |
CVE-2025-22867 | High | 7.5 | 2025-02-06 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_pat… |
CVE-2024-45340 | High | 8.8 | 2025-01-28 | Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not… |
CVE-2023-24531 | Critical | 9.8 | 2024-07-02 | Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a… |
CVE-2024-24787 | Medium | 6.4 | 2024-05-08 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library fl… |
CVE-2023-45285 | High | 7.5 | 2023-12-06 | Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "… |
CVE-2023-39323 | High | 8.1 | 2023-10-05 | Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during com… |
CVE-2023-39320 | Critical | 9.8 | 2023-09-08 | The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" comman… |
CVE-2023-29405 | Critical | 9.8 | 2023-06-08 | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other c… |
CVE-2023-29404 | Critical | 9.8 | 2023-06-08 | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other c… |
CVE-2023-29402 | Critical | 9.8 | 2023-06-08 | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This… |
CVE-2020-28367 | High | 7.5 | 2020-11-18 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a… |
CVE-2020-28366 | High | 7.5 | 2020-11-18 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in… |