—Go
GO-2021-0068· BIT-golang-2021-3115, CVE-2021-3115Arbitrary code injection via the go command with cgo on Windows in cmd/go
Modified: 5/20/2024
package
Go/toolchain
pkg:go/toolchain
—Go
GO-2022-0177· CVE-2017-15041Remote command execution via "go get" in cmd/go
Modified: 5/20/2024
—Go
GO-2022-0189· CVE-2018-16873Remote command execution via "go get" with "-u" flag in cmd/go
Modified: 5/20/2024
—Go
GO-2022-0190· CVE-2018-16874Directory traversal via "go get" command in cmd/go
Modified: 5/20/2024
—Go
GO-2022-0201· CVE-2018-6574Remote command execution via "go get" command with cgo in cmd/go
Modified: 5/20/2024
—Go
GO-2022-0203· CVE-2018-7187Remote command execution via "go get" command with "-insecure" option in cmd/go
Modified: 5/20/2024
—Go
GO-2022-0247· BIT-golang-2021-38297, CVE-2021-38297Buffer overflow in WASM modules in misc/wasm and cmd/link
Modified: 5/20/2024
—Go
GO-2022-0318· BIT-golang-2022-23773, CVE-2022-23773Incorrect access control in the go command in cmd/go/internal/modfetch
Modified: 5/20/2024
—Go
GO-2022-0475· BIT-golang-2020-28366, CVE-2020-28366Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Modified: 5/20/2024
—Go
GO-2022-0476· BIT-golang-2020-28367, CVE-2020-28367Arbitrary code execution via the go command with cgo in cmd/go
Modified: 5/20/2024
—Go
GO-2023-1839· BIT-golang-2023-29402, CVE-2023-29402Code injection via go command with cgo in cmd/go
Modified: 2/4/2026
—Go
GO-2023-1841· BIT-golang-2023-29404, CVE-2023-29404Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
Modified: 2/4/2026
—Go
GO-2023-1842· BIT-golang-2023-29405, CVE-2023-29405Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
Modified: 2/4/2026
—Go
GO-2023-2042· BIT-golang-2023-39320, CVE-2023-39320Arbitrary code execution via go.mod toolchain directive in cmd/go
Modified: 2/4/2026
—Go
GO-2023-2095· BIT-golang-2023-39323, CVE-2023-39323Arbitrary code execution during build via line directives in cmd/go
Modified: 2/4/2026
—Go
GO-2023-2383· BIT-golang-2023-45285, CVE-2023-45285Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Modified: 2/4/2026
—Go
GO-2024-2825· BIT-golang-2024-24787, CVE-2024-24787Arbitrary code execution during build on Darwin in cmd/go
Modified: 2/4/2026
—Go
GO-2024-2962· BIT-golang-2023-24531, CVE-2023-24531Output of "go env" does not sanitize values in cmd/go
Modified: 2/4/2026
—Go
GO-2025-3383· BIT-golang-2024-45340, CVE-2024-45340GOAUTH credential leak in cmd/go
Modified: 1/30/2025
—Go
GO-2025-3428· BIT-golang-2025-22867, CVE-2025-22867Arbitrary code execution during build on darwin in cmd/go
Modified: 2/8/2025
—Go
GO-2025-3828· BIT-golang-2025-4674, CVE-2025-4674Unexpected command execution in untrusted VCS repositories in cmd/go
Modified: 2/4/2026
—Go
GO-2026-4338· BIT-golang-2025-68119, CVE-2025-68119Unexpected code execution when invoking toolchain in cmd/go
Modified: 5/15/2026
—Go
GO-2026-4339· BIT-golang-2025-61731, CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/go
Modified: 8/5/2026
—Go
GO-2026-4433· BIT-golang-2025-61732, CVE-2025-61732Potential code smuggling via doc comments in cmd/cgo
Modified: 5/15/2026
—Go
GO-2026-4867· BIT-golang-2026-27144, CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Modified: 7/30/2026
—Go
GO-2026-4868· BIT-golang-2026-27143, CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Modified: 7/30/2026
—Go
GO-2026-4871· BIT-golang-2026-27140, CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/go
Modified: 5/13/2026
—Go
GO-2026-4978· BIT-golang-2026-39819, CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
Modified: 9/22/2026
—Go
GO-2026-4979· BIT-golang-2026-39817, CVE-2026-39817Invoking "go tool pack" does not sanitize output paths in cmd/go
Modified: 9/22/2026
—Go
GO-2026-4984· BIT-golang-2026-42501, CVE-2026-42501Malicious module proxy can bypass checksum database in cmd/go
Modified: 8/31/2026
—Go
GO-2026-6179· BIT-golang-2026-56865, CVE-2026-56865Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Modified: 8/19/2026
—Go
GO-2026-6180· BIT-golang-2026-56864, CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Modified: 8/19/2026