| CVE-2026-94444 |
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
|
7.8
High
|
Oct 8, 2026 |
| CVE-2026-94447 |
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
|
7.8
High
|
Oct 8, 2026 |
| CVE-2026-56865 |
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
|
8.4
High
|
Aug 13, 2026 |
| CVE-2026-56864 |
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-42501 |
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum…
|
7.5
High
|
May 7, 2026 |
| CVE-2026-39817 |
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not…
|
5.9
Medium
|
May 7, 2026 |
| CVE-2026-39819 |
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")
|
5.3
Medium
|
May 7, 2026 |
| CVE-2026-27140 |
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution…
|
8.8
High
|
Apr 8, 2026 |
| CVE-2025-61731 |
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of…
|
7.8
High
|
Jan 28, 2026 |
| CVE-2025-68119 |
Downloading and building modules with malicious version strings can cause local code execution
|
7.0
High
|
Jan 28, 2026 |
| CVE-2025-4674 |
The go command may execute unexpected commands when operating in untrusted VCS repositories
|
8.6
High
|
Jul 29, 2025 |
| CVE-2025-22867 |
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…
|
7.5
High
|
Feb 6, 2025 |
| CVE-2024-45340 |
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server…
|
8.8
High
|
Jan 28, 2025 |
| CVE-2023-24531 |
Command go env is documented as outputting a shell script containing the Go environment
|
9.8
Critical
|
Jul 2, 2024 |
| CVE-2024-24787 |
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version…
|
6.4
Medium
|
May 8, 2024 |
| CVE-2023-45285 |
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the…
|
Not rated
|
Dec 6, 2023 |
| CVE-2023-39323 |
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and…
|
8.1
High
|
Oct 5, 2023 |
| CVE-2023-39320 |
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to…
|
Not rated
|
Sep 8, 2023 |
| CVE-2023-29405 |
The go command may execute arbitrary code at build time when using cgo
|
9.8
Critical
|
Jun 8, 2023 |
| CVE-2023-29404 |
The go command may execute arbitrary code at build time when using cgo
|
9.8
Critical
|
Jun 8, 2023 |
| CVE-2023-29402 |
The go command may generate unexpected code at build time when using cgo
|
9.8
Critical
|
Jun 8, 2023 |
| CVE-2020-28367 |
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build…
|
Not rated
|
Nov 18, 2020 |
| CVE-2020-28366 |
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build…
|
Not rated
|
Nov 18, 2020 |