title: Arbitrary code execution via the go command with cgo in cmd/go
description: Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
problem types: CWE-94: Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: Go toolchain
product: cmd/go
collectionURL: https://pkg.go.dev
packageName: cmd/go
versions:
version: 0, lessThan: 1.14.12, status: affected, versionType: semver
version: 1.15.0-0, lessThan: 1.15.5, status: affected, versionType: semver
programRoutines:
name: validCompilerFlags
defaultStatus: unaffected
}