Threats tagged 'ghsa-775q-r7gv-cr2x'

A vulnerability in GCC's handling of cgo packages allows arbitrary command execution at link time via untrusted GCC spec files. This occurs when linking with certain flags (-fopenmp, -fopenacc, or -fsanitize=) that cause GCC to evaluate and include spec files from directories that may be untrusted. The Go toolchain now rejects directories containing such spec files and disallows certain flag prefixes to mitigate this risk.