Skip to main content
cve.nowby Sazabi
← Go
GoPackage

toolchain

34 known vulnerabilities (5 critical, 15 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
34 · 5 critical, 15 high, 4 medium
Registry
pkg.go.dev

Advisories 34

  • Checksum database bypass for golang.org/toolchain in cmd/go

    Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

  • Checksum bypass for golang.org/fips140 in cmd/go

    Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

  • Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

    Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

  • Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

    Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

  • Malicious module proxy can bypass checksum database in cmd/go

    Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

  • CVE-2026-39817Medium 5.9

    Invoking "go tool pack" does not sanitize output paths in cmd/go

    Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

  • CVE-2026-39819Medium 5.3

    Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

    Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

  • Code execution vulnerability in SWIG code generation in cmd/go

    Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

  • CVE-2026-27143Critical 9.8

    Missing bound checks can lead to memory corruption in safe Go in cmd/compile

    Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

  • Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

    Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

  • Potential code smuggling via doc comments in cmd/cgo

    Affected: fixed in 1.24.13; from 1.25.0-0, fixed in 1.25.7.

  • Arbitrary file write using cgo pkg-config directive in cmd/go

    Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.

  • Unexpected code execution when invoking toolchain in cmd/go

    Affected: from 1.25.0, fixed in 1.25.6.

  • Unexpected command execution in untrusted VCS repositories in cmd/go

    Affected: fixed in 1.23.11; from 1.24.0-0, fixed in 1.24.5.

  • Arbitrary code execution during build on darwin in cmd/go

    Affected: from 1.24.0-rc.2, fixed in 1.24.0-rc.3.

Show all 34 advisoriesShow fewer advisories

  • GOAUTH credential leak in cmd/go

    Affected: from 1.24.0-0, fixed in 1.24.0-rc.2.

  • CVE-2023-24531Critical 9.8

    Output of "go env" does not sanitize values in cmd/go

    Affected: fixed in 1.21.0-0.

  • CVE-2024-24787Medium 6.4

    Arbitrary code execution during build on Darwin in cmd/go

    Affected: fixed in 1.21.10; from 1.22.0-0, fixed in 1.22.3.

  • Command 'go get' may unexpectedly fallback to insecure git in cmd/go

    Affected: fixed in 1.20.12; from 1.21.0-0, fixed in 1.21.5.

  • Arbitrary code execution during build via line directives in cmd/go

    Affected: fixed in 1.20.9; from 1.21.0-0, fixed in 1.21.2.

  • Arbitrary code execution via go.mod toolchain directive in cmd/go

    Affected: from 1.21.0-0, fixed in 1.21.1.

  • CVE-2023-29405Critical 9.8

    Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

    Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5.

  • CVE-2023-29404Critical 9.8

    Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

    Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5.

  • CVE-2023-29402Critical 9.8

    Code injection via go command with cgo in cmd/go

    Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5.

  • cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.

    Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7.

  • Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when…

    Affected: fixed in 1.16.9; from 1.17.0-0, fixed in 1.17.2.

  • Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get"…

    Affected: fixed in 1.14.14; from 1.15.0-0, fixed in 1.15.7.

  • Arbitrary code execution via the go command with cgo in cmd/go

    Affected: fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5.

  • Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

    Affected: fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5.

  • CVE-2018-16874Medium 6.8

    In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path…

    Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3.

  • In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag…

    Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3.

  • The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go…

    Affected: fixed in 1.9.5; from 1.10.0-0, fixed in 1.10.1.

  • Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source…

    Affected: fixed in 1.8.7; from 1.9.0-0, fixed in 1.9.4.

  • Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution.

    Affected: fixed in 1.8.4; from 1.9.0-0, fixed in 1.9.1.