Go Toolchain Cmd Go vulnerabilities
23 known vulnerabilities affecting go_toolchain/cmd_go.
Total CVEs
23
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL5HIGH15MEDIUM3
Vulnerabilities
Page 2 of 2
CVE-2024-24787P4MEDIUMCVSS 6.4fixed in 1.21.10≥ 1.22.0-0, < 1.22.32024-05-08
CVE-2024-24787 [MEDIUM] CVE-2024-24787: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using t
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
nvd
CVE-2026-39817P4MEDIUMCVSS 5.9fixed in 1.25.10≥ 1.26.0-0, < 1.26.32026-05-07
CVE-2026-39817 [MEDIUM] CWE-787 CVE-2026-39817: The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
nvd
CVE-2026-39819P4MEDIUMCVSS 5.3fixed in 1.25.10≥ 1.26.0-0, < 1.26.32026-05-07
CVE-2026-39819 [MEDIUM] CWE-59 CVE-2026-39819: The "go bug" command writes to two files with predictable names in the system temporary directory (f
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
nvd
← Previous2 / 2