Threats tagged 'ghsa-4x3g-87c5-vq62'

A vulnerability exists in the handling of "#cgo pkg-config:" directives in Go packages, where malicious packages could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. This occurs due to insufficient restrictions on certain pkg-config flags and local ".pc" file paths, potentially allowing manipulation of build configurations. The Go command has been updated to disallow problematic flags and local ".pc" paths and to inspect flags for safer internal linking.