Threat database

CVE-2026-94447 is a high-severity vulnerability in the Go toolchain's cmd/go component involving improper validation of integrity check values. A user working within a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and uses a malicious GOMODPROXY can bypass the intended checksum verification. The issue is addressed by ensuring that golang.org/toolchain always fetches the canonical checksum from the network.

CVE-2026-94444 is a high-severity vulnerability in the Go toolchain's cmd/go module related to improper validation of integrity check values. It allows a user working inside a malicious Go project that defines a fake golang.org/fips140 module and connects to a malicious GOMODPROXY to have an arbitrary module served in place of the legitimate one. The issue is addressed by unpacking and verifying the trusted ziphash for the bundled golang.org/fips140 module to ensure its integrity.

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVE-2026-39819 is a medium severity vulnerability in the Go toolchain's cmd/go component. The 'go bug' command creates temporary files with predictable names in the system temporary directory. This allows an attacker with access to that directory to create symbolic links with those names, potentially causing the command to overwrite unintended files. No official patch or remediation is currently available, and no known exploits have been reported.

CVE-2026-39817 is a medium-severity path traversal vulnerability in the Go toolchain's cmd/go component, specifically affecting the 'go tool pack' subcommand. This flaw allows a malicious archive to write files to arbitrary filesystem locations due to improper sanitization of output filenames when extracting archives. It affects Go versions up to 1.26.0-0. There is currently no official patch or remediation guidance available, and no known exploits have been reported in the wild.

CVE-2026-42501 is a high-severity vulnerability in the Go toolchain's cmd/go module handling that allows a malicious module proxy to bypass checksum database validation due to improper verification of cryptographic signatures. This flaw enables acceptance of empty or unrelated checksum responses as valid, potentially leading to execution of altered Go toolchain versions or modules when using untrusted GOPROXY or GOSUMDB configurations. No official patch or remediation is currently available. Users are advised to upgrade their Go toolchain once a fix is released and can detect potential compromise by regenerating and verifying go.sum files. No known exploits have been reported in the wild at this time.

CVE-2026-27144 is a high-severity vulnerability in the Go toolchain's cmd/compile component. The issue arises because the compiler fails to correctly unwrap pointers during memory move operations due to a no-op interface conversion. This flaw can cause the compiler to incorrectly determine non-overlapping memory moves, potentially leading to memory corruption at runtime. The vulnerability affects Go versions up to 1.26.0-0. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

EPSS 0.5%VulnerabilityGo toolchain#cwe-94Germany+4

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.

EPSS 0.4%VulnerabilityGo toolchain#cwe-78United States+9

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e.via "go get", are not affected.

EPSS 0.4%VulnerabilityGo toolchain#cwe-73Germany+5