Threats affecting pkg:golang/github.com/golang/go/cmd/go

CVE-2026-42501 is a high-severity vulnerability in the Go toolchain's cmd/go module handling that allows a malicious module proxy to bypass checksum database validation due to improper verification of cryptographic signatures. This flaw enables acceptance of empty or unrelated checksum responses as valid, potentially leading to execution of altered Go toolchain versions or modules when using untrusted GOPROXY or GOSUMDB configurations. No official patch or remediation is currently available. Users are advised to upgrade their Go toolchain once a fix is released and can detect potential compromise by regenerating and verifying go.sum files. No known exploits have been reported in the wild at this time.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e.via "go get", are not affected.