Threats tagged 'ghsa-26gx-chjm-8pq7'

A vulnerability in the Go toolchain allows a malicious package using cgo to bypass "#cgo LDFLAGS" validation, potentially leading to unexpected code execution during build time or causing the go command to panic. This occurs due to improper parsing of "//go:cgo_ldflag" directives, where backslash escapes were not handled correctly, allowing disallowed linker flags to be passed to the external linker. Additionally, a slice bounds check issue could cause a panic in the go command during LDFLAGS deduplication. The issue has been addressed by properly handling escaped quotes and fixing the slice bounds check.