CVE-2026-27140highCWE-641

CVE-2026-27140: falha de alta gravidade em Go toolchain cmd/go

Code execution vulnerability in SWIG code generation in cmd/go

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cmd/go+ Monitorar go

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Go toolchain · cmd/go
CVEs relacionadas — Go toolchain cmd/go

No mesmo produto, das mais perigosas para as menos.

CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2020-28366—Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoEPSS 2.3%CVE-2023-39323HIGHArbitrary code execution during build via line directives in cmd/goEPSS 1.9%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-39320—Arbitrary code execution via go.mod toolchain directive in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%