title: Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
description: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
problem types: CWE-94: Improper Control of Generation of Code ("Code Injection")
affected:
{
vendor: Go toolchain
product: cmd/go
collectionURL: https://pkg.go.dev
packageName: cmd/go
versions:
version: 0, lessThan: 1.19.10, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.5, status: affected, versionType: semver
defaultStatus: unaffected
}