Threats tagged 'ghsa-537w-q924-jhpm'

A vulnerability in the Go compiler's handling of "//go:cgo_*" directives allowed malicious packages to inject arbitrary flags into the external linker invocation on ELF platforms. This was due to the compiler and linker not rejecting commas in certain cgo directives, enabling crafted inputs to split linker flags and potentially alter symbol exports. The issue has been addressed by rejecting commas in these directives, changing how the linker passes dynamic linker paths, and preventing symbol overwrites between import and export directives.