Go toolchain vulnerabilities
Every vulnerability this feed holds for Go toolchain, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
11 vulnerabilities tracked.
- — Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags…
- — When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec…
- — When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to…
- — On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l…
- — Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host…
- — Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at…
- — Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated…
- — Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking.
- — Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on…
- — Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library…
- — Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Go toolchain is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Linux Red Hat IBM n/a Apple Google Apache Software Foundation Oracle Corporation zephyrproject FFMPEG Unknown JetBrains Adobe Drupal SAP_SE Cisco Eclipse Foundation OpenEMR go-vikunja hickory-dns n8n-io Hitachi Tanium