# toolchain (Go) vulnerabilities 34 known vulnerabilities (5 critical, 15 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/toolchain ## Advisories (34) ### [CVE-2026-94447](https://cve.now/CVE-2026-94447): Checksum database bypass for golang.org/toolchain in cmd/go - Severity: High 7.8 - Published: Oct 8, 2026 - Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2. ### [CVE-2026-94444](https://cve.now/CVE-2026-94444): Checksum bypass for golang.org/fips140 in cmd/go - Severity: High 7.8 - Published: Oct 8, 2026 - Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2. ### [CVE-2026-56864](https://cve.now/CVE-2026-56864): Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3. ### [CVE-2026-56865](https://cve.now/CVE-2026-56865): Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog - Severity: High 8.4 - Published: Aug 13, 2026 - Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3. ### [CVE-2026-42501](https://cve.now/CVE-2026-42501): Malicious module proxy can bypass checksum database in cmd/go - Severity: High 7.5 - Published: May 7, 2026 - Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3. ### [CVE-2026-39817](https://cve.now/CVE-2026-39817): Invoking "go tool pack" does not sanitize output paths in cmd/go - Severity: Medium 5.9 - Published: May 7, 2026 - Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3. ### [CVE-2026-39819](https://cve.now/CVE-2026-39819): Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go - Severity: Medium 5.3 - Published: May 7, 2026 - Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3. ### [CVE-2026-27140](https://cve.now/CVE-2026-27140): Code execution vulnerability in SWIG code generation in cmd/go - Severity: High 8.8 - Published: Apr 8, 2026 - Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2. ### [CVE-2026-27143](https://cve.now/CVE-2026-27143): Missing bound checks can lead to memory corruption in safe Go in cmd/compile - Severity: Critical 9.8 - Published: Apr 8, 2026 - Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2. ### [CVE-2026-27144](https://cve.now/CVE-2026-27144): Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile - Severity: High 7.1 - Published: Apr 8, 2026 - Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2. ### [CVE-2025-61732](https://cve.now/CVE-2025-61732): Potential code smuggling via doc comments in cmd/cgo - Severity: High 8.6 - Published: Feb 5, 2026 - Affected: fixed in 1.24.13; from 1.25.0-0, fixed in 1.25.7. ### [CVE-2025-61731](https://cve.now/CVE-2025-61731): Arbitrary file write using cgo pkg-config directive in cmd/go - Severity: High 7.8 - Published: Jan 28, 2026 - Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6. ### [CVE-2025-68119](https://cve.now/CVE-2025-68119): Unexpected code execution when invoking toolchain in cmd/go - Severity: High 7.0 - Published: Jan 28, 2026 - Affected: from 1.25.0, fixed in 1.25.6. ### [CVE-2025-4674](https://cve.now/CVE-2025-4674): Unexpected command execution in untrusted VCS repositories in cmd/go - Severity: High 8.6 - Published: Jul 29, 2025 - Affected: fixed in 1.23.11; from 1.24.0-0, fixed in 1.24.5. ### [CVE-2025-22867](https://cve.now/CVE-2025-22867): Arbitrary code execution during build on darwin in cmd/go - Severity: High 7.5 - Published: Feb 6, 2025 - Affected: from 1.24.0-rc.2, fixed in 1.24.0-rc.3. ### [CVE-2024-45340](https://cve.now/CVE-2024-45340): GOAUTH credential leak in cmd/go - Severity: High 8.8 - Published: Jan 28, 2025 - Affected: from 1.24.0-0, fixed in 1.24.0-rc.2. ### [CVE-2023-24531](https://cve.now/CVE-2023-24531): Output of "go env" does not sanitize values in cmd/go - Severity: Critical 9.8 - Published: Jul 2, 2024 - Affected: fixed in 1.21.0-0. ### [CVE-2024-24787](https://cve.now/CVE-2024-24787): Arbitrary code execution during build on Darwin in cmd/go - Severity: Medium 6.4 - Published: May 8, 2024 - Affected: fixed in 1.21.10; from 1.22.0-0, fixed in 1.22.3. ### [CVE-2023-45285](https://cve.now/CVE-2023-45285): Command 'go get' may unexpectedly fallback to insecure git in cmd/go - Severity: Unrated - Published: Dec 6, 2023 - Affected: fixed in 1.20.12; from 1.21.0-0, fixed in 1.21.5. ### [CVE-2023-39323](https://cve.now/CVE-2023-39323): Arbitrary code execution during build via line directives in cmd/go - Severity: High 8.1 - Published: Oct 5, 2023 - Affected: fixed in 1.20.9; from 1.21.0-0, fixed in 1.21.2. ### [CVE-2023-39320](https://cve.now/CVE-2023-39320): Arbitrary code execution via go.mod toolchain directive in cmd/go - Severity: Unrated - Published: Sep 8, 2023 - Affected: from 1.21.0-0, fixed in 1.21.1. ### [CVE-2023-29405](https://cve.now/CVE-2023-29405): Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go - Severity: Critical 9.8 - Published: Jun 8, 2023 - Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5. ### [CVE-2023-29404](https://cve.now/CVE-2023-29404): Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go - Severity: Critical 9.8 - Published: Jun 8, 2023 - Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5. ### [CVE-2023-29402](https://cve.now/CVE-2023-29402): Code injection via go command with cgo in cmd/go - Severity: Critical 9.8 - Published: Jun 8, 2023 - Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5. ### [CVE-2022-23773](https://cve.now/CVE-2022-23773): cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. - Severity: Unrated - Published: Feb 11, 2022 - Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7. ### [CVE-2021-38297](https://cve.now/CVE-2021-38297): Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when… - Severity: Unrated - Published: Oct 18, 2021 - Affected: fixed in 1.16.9; from 1.17.0-0, fixed in 1.17.2. ### [CVE-2021-3115](https://cve.now/CVE-2021-3115): Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get"… - Severity: Unrated - Published: Jan 26, 2021 - Affected: fixed in 1.14.14; from 1.15.0-0, fixed in 1.15.7. ### [CVE-2020-28367](https://cve.now/CVE-2020-28367): Arbitrary code execution via the go command with cgo in cmd/go - Severity: Unrated - Published: Nov 18, 2020 - Affected: fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5. ### [CVE-2020-28366](https://cve.now/CVE-2020-28366): Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo - Severity: Unrated - Published: Nov 18, 2020 - Affected: fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5. ### [CVE-2018-16874](https://cve.now/CVE-2018-16874): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path… - Severity: Medium 6.8 - Published: Dec 14, 2018 - Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3. ### [CVE-2018-16873](https://cve.now/CVE-2018-16873): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag… - Severity: High 7.5 - Published: Dec 14, 2018 - Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3. ### [CVE-2018-7187](https://cve.now/CVE-2018-7187): The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go… - Severity: Unrated - Published: Feb 16, 2018 - Affected: fixed in 1.9.5; from 1.10.0-0, fixed in 1.10.1. ### [CVE-2018-6574](https://cve.now/CVE-2018-6574): Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source… - Severity: Unrated - Published: Feb 7, 2018 - Affected: fixed in 1.8.7; from 1.9.0-0, fixed in 1.9.4. ### [CVE-2017-15041](https://cve.now/CVE-2017-15041): Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. - Severity: Unrated - Published: Oct 5, 2017 - Affected: fixed in 1.8.4; from 1.9.0-0, fixed in 1.9.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/toolchain Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.