Threats tagged 'ghsa-428h-9j26-5fcf'

A vulnerability in the cgo build process allows malicious packages to execute arbitrary code at build time by exploiting certain compiler and linker flags in "#cgo" directives. Flags such as "--sysroot" and "-target" could be abused to redirect compiler components or execute helper tools from attacker-controlled locations. Restrictions have been applied to disallow or validate these flags to prevent exploitation.