| CVE-2026-94444 |
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
|
7.8
Élevée
|
8 oct. 2026 |
| CVE-2026-94447 |
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
|
7.8
Élevée
|
8 oct. 2026 |
| CVE-2026-56865 |
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
|
8.4
Élevée
|
13 août 2026 |
| CVE-2026-56864 |
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
|
7.5
Élevée
|
13 août 2026 |
| CVE-2026-42501 |
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum…
|
7.5
Élevée
|
7 mai 2026 |
| CVE-2026-39817 |
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not…
|
5.9
Moyenne
|
7 mai 2026 |
| CVE-2026-39819 |
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")
|
5.3
Moyenne
|
7 mai 2026 |
| CVE-2026-27140 |
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution…
|
8.8
Élevée
|
8 avr. 2026 |
| CVE-2025-61731 |
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of…
|
7.8
Élevée
|
28 janv. 2026 |
| CVE-2025-68119 |
Downloading and building modules with malicious version strings can cause local code execution
|
7.0
Élevée
|
28 janv. 2026 |
| CVE-2025-4674 |
The go command may execute unexpected commands when operating in untrusted VCS repositories
|
8.6
Élevée
|
29 juil. 2025 |
| CVE-2025-22867 |
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…
|
7.5
Élevée
|
6 févr. 2025 |
| CVE-2024-45340 |
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server…
|
8.8
Élevée
|
28 janv. 2025 |
| CVE-2023-24531 |
Command go env is documented as outputting a shell script containing the Go environment
|
9.8
Critique
|
2 juil. 2024 |
| CVE-2024-24787 |
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…
|
6.4
Moyenne
|
8 mai 2024 |
| CVE-2023-45285 |
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the…
|
Non notée
|
6 déc. 2023 |
| CVE-2023-39323 |
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and…
|
8.1
Élevée
|
5 oct. 2023 |
| CVE-2023-39320 |
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to…
|
Non notée
|
8 sept. 2023 |
| CVE-2023-29405 |
The go command may execute arbitrary code at build time when using cgo
|
9.8
Critique
|
8 juin 2023 |
| CVE-2023-29404 |
The go command may execute arbitrary code at build time when using cgo
|
9.8
Critique
|
8 juin 2023 |
| CVE-2023-29402 |
The go command may generate unexpected code at build time when using cgo
|
9.8
Critique
|
8 juin 2023 |
| CVE-2020-28367 |
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build…
|
Non notée
|
18 nov. 2020 |
| CVE-2020-28366 |
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build…
|
Non notée
|
18 nov. 2020 |