Threats tagged 'ghsa-6f8j-v7cw-qxpp'

A vulnerability exists in the use of Clang or GCC compilers when building malicious Go packages that use cgo. Malicious packages can exploit certain compiler and linker flags (-gen-* and -gnat*) in #cgo directives to cause unexpected code execution during build or write files to arbitrary directories. These flags were previously allowed due to wildcard matching in the allowlists, enabling attackers to write compilation database fragments and sidecar output files outside intended locations and to desynchronize flag argument parsing, potentially passing unvalidated inputs to the linker. The problematic flags are now disallowed in #cgo compiler and linker flags to mitigate this issue.