Vulnerabilities of Go toolchain cmd/cgo
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2025-61732 | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary | 8.6 High | Feb 5, 2026 |
| CVE-2023-29405 | The go command may execute arbitrary code at build time when using cgo | 9.8 Critical | Jun 8, 2023 |
| CVE-2020-28366 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build… | Not rated | Nov 18, 2020 |