Not rated
CVE-2020-28367 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build…
Description
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
Affected products and versions
References
- go.dev go.dev
- go.googlesource.com go.googlesource.com
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- lists.debian.org lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of cmd/go
The 23 CVEs of cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
High
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
High
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
High
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
7.5
High