Threats tagged 'ghsa-f47v-97w8-qc5g'

A vulnerability in the Go compiler's handling of cgo linker flags could allow arbitrary code execution at link time. This occurs when malicious packages pass specially crafted linker script files via "#cgo LDFLAGS". The issue involves improper handling of split "-Wl," flags that consume a following argument, which could be interpreted as positional input files or linker scripts by the host linker, particularly GNU ld.bfd. The Go command now enforces stricter validation by requiring "-Wl," prefixes on certain flags, verifying that flags do not reference linker script files, and disallowing specific problematic flags.