—
GO-2022-0475
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Quick fix
GO-2022-0475 — toolchain: upgrade to the fixed version with the command below.
go get toolchain@v1.14.12Details
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code.
This can be caused by malicious unquoted symbol name in a linked object file.
Are you affected?
Enter the version of the package you're using.