Approved changes feed: RSS · Atom
cpe:2.3:a:go_toolchain:cmd/cgo:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Go Toolchain (054910d2-b151-5450-9b9a-343321960c32) |
|---|---|
| Product | Cmd/Cgo (7503cf97-3772-5fe3-affd-966bbf96d783) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-61732 |
vulnerable | 2026-06-08 07:37:27.966221 |
Potential code smuggling via doc comments in cmd/cgo
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Published: 2026-02-05T03:42:26.392Z
Updated: 2026-08-26T12:05:04.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29405 |
vulnerable | 2026-06-08 06:02:40.121684 |
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
Published: 2023-06-08T20:19:19.267Z
Updated: 2025-01-06T19:44:24.568Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28366 |
vulnerable | 2026-06-08 05:23:54.035719 |
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Published: 2020-11-18T00:00:00.000Z
Updated: 2024-08-04T16:33:58.955Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.