Vendor

    Go Toolchain

    26 known vulnerabilities in products by Go Toolchain, 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Go Toolchain
    CriticalCVE-2023-29404

    Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

    also in 3 other products

    		9.8
    CriticalCVE-2023-39320

    Arbitrary code execution via go.mod toolchain directive in cmd/go

    also in 1 other product

    		9.8
    CriticalCVE-2023-29405

    Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

    also in 3 other products

    		9.8
    CriticalCVE-2023-29402

    Code injection via go command with cgo in cmd/go

    also in 4 other products

    		9.8
    HighCVE-2023-39323

    Arbitrary code execution during build via line directives in cmd/go

    also in 2 other products

    		8.1
    HighCVE-2020-28367

    Arbitrary code execution via the go command with cgo in cmd/go

    also in 2 other products

    		7.5
    HighCVE-2020-28366

    Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

    also in 5 other products

    		7.5
    CriticalCVE-2026-27140

    Code execution vulnerability in SWIG code generation in cmd/go

    also in 2 other products

    		9.8
    CriticalCVE-2023-24531

    Output of "go env" does not sanitize values in cmd/go

    also in 2 other products

    		9.8
    CriticalCVE-2026-27143

    Missing bound checks can lead to memory corruption in safe Go in cmd/compile

    also in 2 other products

    		9.8
    HighCVE-2023-45285

    Command 'go get' may unexpectedly fallback to insecure git in cmd/go

    also in 1 other product

    		7.5
    HighCVE-2024-45340

    GOAUTH credential leak in cmd/go

    		8.8
    HighCVE-2025-61732

    Potential code smuggling via doc comments in cmd/cgo

    also in 3 other products

    		8.6
    HighCVE-2025-61731

    Arbitrary file write using cgo pkg-config directive in cmd/go

    also in 3 other products

    		7.8
    HighCVE-2026-94444

    Checksum bypass for golang.org/fips140 in cmd/go

    also in 2 other products

    		7.8
    HighCVE-2025-4674

    Unexpected command execution in untrusted VCS repositories in cmd/go

    also in 1 other product

    		8.6
    HighCVE-2025-22867

    Arbitrary code execution during build on darwin in cmd/go

    		7.5
    HighCVE-2026-56865

    Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

    also in 3 other products

    		8.4
    HighCVE-2026-94447

    Checksum database bypass for golang.org/toolchain in cmd/go

    also in 2 other products

    		7.0
    HighCVE-2026-56864

    Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

    also in 2 other products

    		7.5
    MediumCVE-2024-24787

    Arbitrary code execution during build on Darwin in cmd/go

    also in 1 other product

    		6.4
    HighCVE-2026-27144

    Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

    also in 2 other products

    		7.7
    HighCVE-2025-68119

    Unexpected code execution when invoking toolchain in cmd/go

    also in 2 other products

    		7.0
    HighCVE-2026-42501

    Malicious module proxy can bypass checksum database in cmd/go

    also in 2 other products

    		7.5
    MediumCVE-2026-39817

    Invoking "go tool pack" does not sanitize output paths in cmd/go

    also in 3 other products

    		5.9

    All vulnerabilities in search

    Products

    Products by Go Toolchain
    Cmd/go230
    Cmd/cgo30