Threats tagged 'ghsa-qxq7-88pj-2ph7'

On Darwin systems, a vulnerability exists where building a malicious package using cgo with certain linker flags can lead to arbitrary code execution. This occurs because the Apple linker recombines separated '-l' and 'to_library' arguments into a single flag that loads an arbitrary LTO plugin dynamic library at link time. The Go command has been updated to disallow these risky linker flags and patterns to prevent exploitation.