Product by Go Toolchain

    Cmd/go

    23 known vulnerabilities in Cmd/go (Go Toolchain), 0 of them actively exploited (CISA KEV).

    Key figures

    23

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Cmd/go (Go Toolchain)
    CriticalCVE-2023-29404

    Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

    also in 3 other products

    		9.8
    CriticalCVE-2023-39320

    Arbitrary code execution via go.mod toolchain directive in cmd/go

    also in 1 other product

    		9.8
    CriticalCVE-2023-29405

    Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

    also in 4 other products

    		9.8
    CriticalCVE-2023-29402

    Code injection via go command with cgo in cmd/go

    also in 4 other products

    		9.8
    HighCVE-2023-39323

    Arbitrary code execution during build via line directives in cmd/go

    also in 2 other products

    		8.1
    HighCVE-2020-28367

    Arbitrary code execution via the go command with cgo in cmd/go

    also in 2 other products

    		7.5
    HighCVE-2020-28366

    Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

    also in 6 other products

    		7.5
    CriticalCVE-2026-27140

    Code execution vulnerability in SWIG code generation in cmd/go

    also in 2 other products

    		9.8
    CriticalCVE-2023-24531

    Output of "go env" does not sanitize values in cmd/go

    also in 2 other products

    		9.8
    HighCVE-2023-45285

    Command 'go get' may unexpectedly fallback to insecure git in cmd/go

    also in 1 other product

    		7.5
    HighCVE-2024-45340

    GOAUTH credential leak in cmd/go

    		8.8
    HighCVE-2025-61731

    Arbitrary file write using cgo pkg-config directive in cmd/go

    also in 3 other products

    		7.8
    HighCVE-2026-94444

    Checksum bypass for golang.org/fips140 in cmd/go

    also in 2 other products

    		7.8
    HighCVE-2025-22867

    Arbitrary code execution during build on darwin in cmd/go

    		7.5
    HighCVE-2026-56865

    Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

    also in 3 other products

    		8.4
    HighCVE-2026-94447

    Checksum database bypass for golang.org/toolchain in cmd/go

    also in 2 other products

    		7.0
    HighCVE-2025-4674

    Unexpected command execution in untrusted VCS repositories in cmd/go

    also in 1 other product

    		8.6
    HighCVE-2026-56864

    Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

    also in 2 other products

    		7.5
    MediumCVE-2024-24787

    Arbitrary code execution during build on Darwin in cmd/go

    also in 1 other product

    		6.4
    HighCVE-2025-68119

    Unexpected code execution when invoking toolchain in cmd/go

    also in 2 other products

    		7.0
    HighCVE-2026-42501

    Malicious module proxy can bypass checksum database in cmd/go

    also in 2 other products

    		7.5
    MediumCVE-2026-39817

    Invoking "go tool pack" does not sanitize output paths in cmd/go

    also in 3 other products

    		5.9
    MediumCVE-2026-39819

    Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

    also in 3 other products

    		5.3

    All products by Go Toolchain