Threats tagged 'ghsa-jgj7-3254-vwmv'

A vulnerability in the Go compiler and linker on Windows allows malicious packages using "//go:cgo_import_dynamic" directives or crafted PE objects to pass unsafe library arguments to the external linker. The issue arises because the compiler previously only checked the first character of library names and did not validate imported DLL names extracted from PE files, enabling path traversal and special character injection. The compiler and linker now fully validate library names and reject unsafe characters and path traversal sequences.