8.1
High
CVE-2023-39323 Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and…
Description
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
Affected products and versions
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.netapp.com security.netapp.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- security.gentoo.org security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of cmd/go
The 23 CVEs of cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
High
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
High
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
High
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
7.5
High