The vulnerability in cmd/go arises from improper neutralization of special elements in OS command arguments (CWE-78 and CWE-88). Specifically, the '#cgo pkg-config:' directive in Go source files can be abused by an attacker to pass a '--log-file' argument to pkg-config, causing it to write to an arbitrary file controlled by the attacker. This arbitrary file write can modify or poison build artifacts and caches, impacting build integrity and behavior. The vulnerability requires local access with at least low privileges and no user interaction. Red Hat has released security updates for golang packages to address this issue.

An attacker with the ability to build malicious Go source files can cause arbitrary file writes during the build process, potentially leading to broken builds, altered tool behavior, and poisoned caches or artifacts. Although this does not directly enable code execution, it compromises build integrity and can disrupt development workflows. The impact affects confidentiality, integrity, and availability of the build environment and artifacts.

Red Hat has released updated golang packages that fix this vulnerability. Users should apply these security updates as soon as possible. Currently, no effective mitigations meet Red Hat's criteria for ease of use and deployment. Until patched, restricting build permissions and limiting untrusted source builds may reduce risk. Refer to Red Hat advisory RHSA-2026:5943 for update instructions.