cmd/go vulnerabilities and CVEs

Known vulnerabilities affecting cmd/go, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

9 vulnerabilities tracked.

• — Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags… CVE-2026-97033 11 Nov 2026
• — When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec… CVE-2026-97034 11 Nov 2026
• — When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to… CVE-2026-97035 11 Nov 2026
• — On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l… CVE-2026-97036 11 Nov 2026
• — Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host… CVE-2026-97037 11 Nov 2026
• — Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at… CVE-2026-97038 11 Nov 2026
• — Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated… CVE-2026-97039 11 Nov 2026
• — Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. CVE-2026-97040 11 Nov 2026
• — Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or… CVE-2026-97043 11 Nov 2026