Go toolchain cmd/go
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-94447 | < 1.26.9 ; 1.27.0-0 – < 1.27.2 | Checksum database bypass for golang.org/toolchain in cmd/go | HIGH 7.8 | 0.1 % | ||
| CVE-2026-94444 | < 1.26.9 ; 1.27.0-0 – < 1.27.2 | Checksum bypass for golang.org/fips140 in cmd/go | HIGH 7.8 | 0.1 % | ||
| CVE-2026-56865 | < 1.25.13 ; 1.26.0-0 – < 1.26.6 ; 1.27.0-0 – < 1.27.0-rc.3 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56864 | < 1.25.13 ; 1.26.0-0 – < 1.26.6 ; 1.27.0-0 – < 1.27.0-rc.3 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb | HIGH 7.5 | 0.3 % | ||
| CVE-2026-42501 | < 1.25.10 ; 1.26.0-0 – < 1.26.3 | Malicious module proxy can bypass checksum database in cmd/go | HIGH 7.5 | 0.2 % | ||
| CVE-2026-39819 | < 1.25.10 ; 1.26.0-0 – < 1.26.3 | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-39817 | < 1.25.10 ; 1.26.0-0 – < 1.26.3 | Invoking "go tool pack" does not sanitize output paths in cmd/go | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-27140 | < 1.25.9 ; 1.26.0-0 – < 1.26.2 | Code execution vulnerability in SWIG code generation in cmd/go | HIGH 8.8 | 0.7 % | ||
| CVE-2025-68119 | 1.25.0 – < 1.25.6 | Unexpected code execution when invoking toolchain in cmd/go | HIGH 7.0 | 0.4 % | ||
| CVE-2025-61731 | < 1.24.12 ; 1.25.0 – < 1.25.6 | Arbitrary file write using cgo pkg-config directive in cmd/go | HIGH 8.6 | 0.6 % | ||
| CVE-2025-4674 | < 1.23.11 ; 1.24.0-0 – < 1.24.5 | Unexpected command execution in untrusted VCS repositories in cmd/go | HIGH 8.6 | 0.4 % | ||
| CVE-2025-22867 | 1.24.0-rc.2 – < 1.24.0-rc.3 | Arbitrary code execution during build on darwin in cmd/go | HIGH 7.5 | 0.6 % | ||
| CVE-2024-45340 | 1.24.0-0 – < 1.24.0-rc.2 | GOAUTH credential leak in cmd/go | HIGH 8.8 | 0.7 % | ||
| CVE-2023-24531 | < 1.21.0-0 | Output of "go env" does not sanitize values in cmd/go | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-24787 | < 1.21.10 ; 1.22.0-0 – < 1.22.3 | Arbitrary code execution during build on Darwin in cmd/go | MEDIUM 6.4 | 0.8 % | ||
| CVE-2023-45285 | < 1.20.12 ; 1.21.0-0 – < 1.21.5 | Command 'go get' may unexpectedly fallback to insecure git in cmd/go | HIGH 7.5 | 1.1 % | ||
| CVE-2023-39323 | < 1.20.9 ; 1.21.0-0 – < 1.21.2 | Arbitrary code execution during build via line directives in cmd/go | HIGH 8.1 | 1.9 % | ||
| CVE-2023-39320 | 1.21.0-0 – < 1.21.1 | Arbitrary code execution via go.mod toolchain directive in cmd/go | CRITICAL 9.8 | 1.8 % | ||
| CVE-2023-29405 | < 1.19.10 ; 1.20.0-0 – < 1.20.5 | Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go | CRITICAL 9.8 | 1.7 % | ||
| CVE-2023-29404 | < 1.19.10 ; 1.20.0-0 – < 1.20.5 | Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go | CRITICAL 9.8 | 1.8 % | ||
| CVE-2023-29402 | < 1.19.10 ; 1.20.0-0 – < 1.20.5 | Code injection via go command with cgo in cmd/go | CRITICAL 9.8 | 1.7 % | ||
| CVE-2020-28367 | < 1.14.12 ; 1.15.0-0 – < 1.15.5 | Arbitrary code execution via the go command with cgo in cmd/go | HIGH 7.5 | 2.4 % | ||
| CVE-2020-28366 | < 1.14.12 ; 1.15.0-0 – < 1.15.5 | Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo | HIGH 7.5 | 2.3 % |